CVEs published February 17, 2020
63 CVEs were published on February 17, 2020: 0 critical, 4 high.
- Published
- 63
- Critical
- 0
- High
- 4
- Medium
- 2
- Low
- 0
- Unrated
- 57
- Now in CISA KEV
- 0
- Fix available
- 5
Most affected products
- Huawei NIP6800 · Huawei Secospace USG6600 +1
- 4
- Huawei NIP6800 · Huawei Secospace USG6600, USG9500
- 4
- Huawei GaussDB
- 2
- Ipsilon
- 2
- ABB Asset Suite
- 1
- codecov npm module · codecov
- 1
- Collabtive
- 1
- Huawei CloudLink Board · Huawei DP300 +2
- 1
- Huawei Ever-L29B · HUAWEI Mate 20 RS +2
- 1
- Huawei NGFW Module, NIP6300, NIP6600, Secospace USG6500, Se…
- 1
High 4
- CVE-2020-1693A flaw was found in Spacewalk up to version 2.9 where it was vulnerable to XML internal entity attacks via the /rpc/api endpoint.Red Hat spacewalk
- CVE-2019-18998Asset Suite Direct Object Reference AccessABB Asset Suite
- CVE-2020-1704An insecure modification vulnerability in the /etc/passwd file was found in all versions of OpenShift ServiceMesh (maistra) before 1.0.8 in Red Hat openshift-service-mesh/kiali-rhel7-operator
- CVE-2020-1692Moodle before version 3.7.2 is vulnerable to information exposure of service tokens for users enrolled in the same course.The Moodle Project moodle · moodle/moodle
Medium, low and unrated 59
- CVE-2020-1882Huawei mobile phones Ever-L29B versions earlier than 10.0.0.180(C185E6R3P3), earlier than 10.0.0.180(C432E6R1P7), earlier than 10.0.0.180(C6Huawei Ever-L29B · HUAWEI Mate 20 RS +2
- CVE-2020-1830Huawei NIP6800 versions V500R001C30, V500R001C60SPC500, and V500R005C00; Secospace USG6600 and USG9500 versions V500R001C30SPC200, V500R001CHuawei NIP6800 · Huawei Secospace USG6600, USG9500
- CVE-2020-1811GaussDB 200 with version of 6.5.1 have a command injection vulnerability.Huawei GaussDB
- CVE-2020-1816Huawei NIP6800 versions V500R001C30, V500R001C60SPC500, and V500R005C00; Secospace USG6600 and USG9500 versions V500R001C30SPC200, V500R001CHuawei NIP6800 · Huawei Secospace USG6600, USG9500
- CVE-2020-1815Huawei NIP6800 versions V500R001C30, V500R001C60SPC500, and V500R005C00; Secospace USG6600 and USG9500 versions V500R001C30SPC200, V500R001CHuawei NIP6800 · Huawei Secospace USG6600, USG9500
- CVE-2014-8089SQL injection vulnerability in Zend Framework before 1.12.9, 2.2.x before 2.2.8, and 2.3.x before 2.3.3, when using the sqlsrv PHP extensionzendframework/zendframework1 · zendframework/zend-db +1
- CVE-2015-8751Integer overflow in the jas_matrix_create function in JasPer allows context-dependent attackers to have unspecified impact via a crafted JPE
- CVE-2014-4981LPAR2RRD in 3.5 and earlier allows remote attackers to execute arbitrary commands due to insufficient input sanitization of the web GUI para
- CVE-2014-7236Eval injection vulnerability in lib/TWiki/Plugins.pm in TWiki before 6.0.1 allows remote attackers to execute arbitrary Perl code via the de
- CVE-2014-1947Stack-based buffer overflow in the WritePSDImage function in coders/psd.c in ImageMagick 6.5.4 and earlier allows remote attackers to cause
- CVE-2020-1853GaussDB 200 with version of 6.5.1 have a path traversal vulnerability.Huawei GaussDB
- CVE-2020-1841Huawei CloudLink Board version 20.0.0; DP300 version V500R002C00; RSE6500 versions V100R001C00, V500R002C00, and V500R002C00SPC900; and TE60Huawei CloudLink Board · Huawei DP300 +2
- CVE-2020-1827Huawei NIP6800 versions V500R001C30, V500R001C60SPC500, and V500R005C00SPC100; and Secospace USG6600 and USG9500 versions V500R001C30SPC200,Huawei NIP6800 · Huawei Secospace USG6600, USG9500
- CVE-2020-1856Huawei NGFW Module, NIP6300, NIP6600, Secospace USG6500, Secospace USG6600, and USG9500 versions V500R001C30, V500R001C60, and V500R005C00 hHuawei NGFW Module, NIP6300, NIP6600, Secospace USG6500, Se…
- CVE-2020-7959LabVantage LIMS 8.3 does not properly maintain the confidentiality of database names.
- CVE-2020-1829Huawei NIP6800 versions V500R001C30 and V500R001C60SPC500; and Secospace USG6600 and USG9500 versions V500R001C30SPC200, V500R001C30SPC600, Huawei NIP6800 · Huawei Secospace USG6600 +1
- CVE-2020-8768An issue was discovered on Phoenix Contact Emalytics Controller ILC 2050 BI before 1.2.3 and BI-L before 1.2.3 devices.
- CVE-2020-1857Huawei NIP6800 versions V500R001C30, V500R001C60SPC500, and V500R005C00SPC100; and Secospace USG6600 and USG9500 versions V500R001C30SPC200,Huawei NIP6800 · Huawei Secospace USG6600 +1
- CVE-2019-19325SilverStripe through 4.4.x before 4.4.5 and 4.5.x before 4.5.2 allows Reflected XSS on the login form and custom forms.silverstripe/framework
- CVE-2020-1828Huawei NIP6800 versions V500R001C30, V500R001C60SPC500, and V500R005C00; and Secospace USG6600 and USG9500 versions V500R001C30SPC200, V500RHuawei NIP6800 · Huawei Secospace USG6600 +1
- CVE-2020-1858Huawei products NIP6800 versions V500R001C30, V500R001C60SPC500, and V500R005C00SPC100; Secospace USG6600 versions V500R001C30SPC600, V500R0Huawei NIP6800 · Huawei Secospace USG6600 +1
- CVE-2020-7597codecov-node npm module before 3.6.5 allows remote attackers to execute arbitrary commands.The value provided as part of the gcov-root argumcodecov npm module · codecov
- CVE-2019-20474An issue was discovered in Zoho ManageEngine Remote Access Plus 10.0.447.
- CVE-2013-7324Webkit-GTK 2.x (any version with HTML5 audio/video support based on GStreamer) allows remote attackers to trigger unexpectedly high sound vo
- CVE-2015-5216The Identity Provider (IdP) server in Ipsilon 0.1.0 before 1.0.1 does not properly escape certain characters in a Python exception-message tIpsilon
- CVE-2015-4715The fetch function in OAuth/Curl.php in Dropbox-PHP, as used in ownCloud Server before 6.0.8, 7.x before 7.0.6, and 8.x before 8.0.4 when an
- CVE-2015-6922Kaseya Virtual System Administrator (VSA) 7.x before 7.0.0.33, 8.x before 8.0.0.23, 9.0 before 9.0.0.19, and 9.1 before 9.1.0.9 does not pro
- CVE-2015-0258Multiple incomplete blacklist vulnerabilities in the avatar upload functionality in manageuser.php in Collabtive before 2.1 allow remote autCollabtive
- CVE-2020-9043The wpCentral plugin before 1.5.1 for WordPress allows disclosure of the connection key.
- CVE-2019-12954SolarWinds Network Performance Monitor (Orion Platform 2018, NPM 12.3, NetPath 1.1.3) allows XSS by authenticated users via a crafted onerro
- CVE-2013-3722A Denial of Service (infinite loop) exists in OpenSIPS before 1.10 in lookup.c.
- CVE-2013-3738A File Inclusion vulnerability exists in Zabbix 2.0.6 due to inadequate sanitization of request strings in CGI scripts, which could let a re
- CVE-2020-9038Joplin through 1.0.184 allows Arbitrary File Read via XSS.joplin
- CVE-2020-6850Utilities.php in the miniorange-saml-20-single-sign-on plugin before 4.8.84 for WordPress allows XSS via a crafted SAML XML Response to wp-l
- CVE-2020-8427In Unitrends Backup before 10.4.1, an HTTP request parameter was not properly sanitized, allowing for SQL injection that resulted in an auth
- CVE-2020-8518Horde Groupware Webmail Edition 5.2.22 allows injection of arbitrary PHP code via CSV data, leading to remote code execution.
- CVE-2020-8795In GitLab Enterprise Edition (EE) 12.5.0 through 12.7.5, sharing a group with a group could grant project access to unauthorized users.
- CVE-2020-9006The Popup Builder plugin 2.2.8 through 2.6.7.6 for WordPress is vulnerable to SQL injection (in the sgImportPopups function in sg_popup_ajax
- CVE-2019-12825Unauthorized Access to the Container Registry of other groups was discovered in GitLab Enterprise 12.0.0-pre.
- CVE-2020-9005meshsystem.dll in Valve Dota 2 through 2020-02-17 allows remote attackers to achieve code execution or denial of service by creating a gamin
- CVE-2020-5531Mitsubishi Electric MELSEC C Controller Module and MELIPC Series MI5000 MELSEC-Q Series C Controller Module(Q24DHCCPU-V, Q24DHCCPU-VG User EMitsubishi Electric MELSEC C Controller Module and MELIPC S…
- CVE-2020-7252Unquoted service executable pathMcAfee Data Exchange Layer (DXL) Broker
- CVE-2020-9020Iteris Vantage Velocity Field Unit 2.3.1, 2.4.2, and 3.0 devices allow the injection of OS commands into cgi-bin/timeconfig.py via shell met
- CVE-2020-9021Post Oak AWAM Bluetooth Field Device 7400v2.08.21.2018, 7800SD.2015.1.16, 2011.3, 7400v2.02.01.2019, and 7800SD.2012.12.5 is vulnerable to i
- CVE-2020-9022An issue was discovered on Xirrus XR520, XR620, XR2436, and XH2-120 devices.
- CVE-2020-9023Iteris Vantage Velocity Field Unit 2.3.1 and 2.4.2 devices have two users that are not documented and are configured with weak passwords (Us
- CVE-2020-9024Iteris Vantage Velocity Field Unit 2.3.1 and 2.4.2 devices have world-writable permissions for the /root/cleardata.pl (executed as root by c
- CVE-2020-9025Iteris Vantage Velocity Field Unit 2.4.2 devices have multiple stored XSS issues in all parameters of the Start Data Viewer feature of the /
- CVE-2020-9026ELTEX NTP-RG-1402G 1v10 3.25.3.32 devices allow OS command injection via the PING field of the resource ping.cmd.
- CVE-2020-9027ELTEX NTP-RG-1402G 1v10 3.25.3.32 devices allow OS command injection via the TRACE field of the resource ping.cmd.
- CVE-2020-9028Symmetricom SyncServer S100 2.90.70.3, S200 1.30, S250 1.25, S300 2.65.0, and S350 2.80.1 devices allow stored XSS via the newUserName param
- CVE-2020-9029Symmetricom SyncServer S100 2.90.70.3, S200 1.30, S250 1.25, S300 2.65.0, and S350 2.80.1 devices allow Directory Traversal via the FileName
- CVE-2020-9030Symmetricom SyncServer S100 2.90.70.3, S200 1.30, S250 1.25, S300 2.65.0, and S350 2.80.1 devices allow Directory Traversal via the FileName
- CVE-2020-9031Symmetricom SyncServer S100 2.90.70.3, S200 1.30, S250 1.25, S300 2.65.0, and S350 2.80.1 devices allow Directory Traversal via the FileName
- CVE-2020-9032Symmetricom SyncServer S100 2.90.70.3, S200 1.30, S250 1.25, S300 2.65.0, and S350 2.80.1 devices allow Directory Traversal via the FileName
- CVE-2020-9033Symmetricom SyncServer S100 2.90.70.3, S200 1.30, S250 1.25, S300 2.65.0, and S350 2.80.1 devices allow Directory Traversal via the FileName
- CVE-2020-9034Symmetricom SyncServer S100 2.90.70.3, S200 1.30, S250 1.25, S300 2.65.0, and S350 2.80.1 devices mishandle session validation, leading to u
- CVE-2015-5215The default configuration of the Jinja templating engine used in the Identity Provider (IdP) server in Ipsilon 0.1.0 before 1.0.1 does not eIpsilon
- CVE-2019-10790taffydb npm module, vulnerable in all versions up to and including 2.7.3, allows attackers to forge adding additional properties into user-itaffy npm module · taffy +1