# CVEs published 2020-02-17

63 CVEs were published on February 17, 2020: 0 critical, 4 high. Days are UTC.

- [CVE-2020-1882](https://cve.now/CVE-2020-1882.md): Huawei mobile phones Ever-L29B versions earlier than 10.0.0.180(C185E6R3P3), earlier than 10.0.0.180(C432E6R1P7), earlier than 10.0.0.180(C6 (no CVSS, Huawei Ever-L29B · HUAWEI Mate 20 RS +2)
- [CVE-2020-1830](https://cve.now/CVE-2020-1830.md): Huawei NIP6800 versions V500R001C30, V500R001C60SPC500, and V500R005C00; Secospace USG6600 and USG9500 versions V500R001C30SPC200, V500R001C (no CVSS, Huawei NIP6800 · Huawei Secospace USG6600, USG9500)
- [CVE-2020-1811](https://cve.now/CVE-2020-1811.md): GaussDB 200 with version of 6.5.1 have a command injection vulnerability. (no CVSS, Huawei GaussDB)
- [CVE-2020-1816](https://cve.now/CVE-2020-1816.md): Huawei NIP6800 versions V500R001C30, V500R001C60SPC500, and V500R005C00; Secospace USG6600 and USG9500 versions V500R001C30SPC200, V500R001C (no CVSS, Huawei NIP6800 · Huawei Secospace USG6600, USG9500)
- [CVE-2020-1815](https://cve.now/CVE-2020-1815.md): Huawei NIP6800 versions V500R001C30, V500R001C60SPC500, and V500R005C00; Secospace USG6600 and USG9500 versions V500R001C30SPC200, V500R001C (no CVSS, Huawei NIP6800 · Huawei Secospace USG6600, USG9500)
- [CVE-2014-8089](https://cve.now/CVE-2014-8089.md): SQL injection vulnerability in Zend Framework before 1.12.9, 2.2.x before 2.2.8, and 2.3.x before 2.3.3, when using the sqlsrv PHP extension (no CVSS, zendframework/zendframework1 · zendframework/zend-db +1)
- [CVE-2015-8751](https://cve.now/CVE-2015-8751.md): Integer overflow in the jas\_matrix\_create function in JasPer allows context-dependent attackers to have unspecified impact via a crafted JPE (no CVSS)
- [CVE-2014-4981](https://cve.now/CVE-2014-4981.md): LPAR2RRD in 3.5 and earlier allows remote attackers to execute arbitrary commands due to insufficient input sanitization of the web GUI para (no CVSS)
- [CVE-2014-7236](https://cve.now/CVE-2014-7236.md): Eval injection vulnerability in lib/TWiki/Plugins.pm in TWiki before 6.0.1 allows remote attackers to execute arbitrary Perl code via the de (no CVSS)
- [CVE-2014-1947](https://cve.now/CVE-2014-1947.md): Stack-based buffer overflow in the WritePSDImage function in coders/psd.c in ImageMagick 6.5.4 and earlier allows remote attackers to cause (no CVSS)
- [CVE-2020-1853](https://cve.now/CVE-2020-1853.md): GaussDB 200 with version of 6.5.1 have a path traversal vulnerability. (no CVSS, Huawei GaussDB)
- [CVE-2020-1841](https://cve.now/CVE-2020-1841.md): Huawei CloudLink Board version 20.0.0; DP300 version V500R002C00; RSE6500 versions V100R001C00, V500R002C00, and V500R002C00SPC900; and TE60 (no CVSS, Huawei CloudLink Board · Huawei DP300 +2)
- [CVE-2020-1827](https://cve.now/CVE-2020-1827.md): Huawei NIP6800 versions V500R001C30, V500R001C60SPC500, and V500R005C00SPC100; and Secospace USG6600 and USG9500 versions V500R001C30SPC200, (no CVSS, Huawei NIP6800 · Huawei Secospace USG6600, USG9500)
- [CVE-2020-1856](https://cve.now/CVE-2020-1856.md): Huawei NGFW Module, NIP6300, NIP6600, Secospace USG6500, Secospace USG6600, and USG9500 versions V500R001C30, V500R001C60, and V500R005C00 h (no CVSS, Huawei NGFW Module, NIP6300, NIP6600, Secospace USG6500, Se…)
- [CVE-2020-7959](https://cve.now/CVE-2020-7959.md): LabVantage LIMS 8.3 does not properly maintain the confidentiality of database names. (no CVSS)
- [CVE-2020-1829](https://cve.now/CVE-2020-1829.md): Huawei NIP6800 versions V500R001C30 and V500R001C60SPC500; and Secospace USG6600 and USG9500 versions V500R001C30SPC200, V500R001C30SPC600, (no CVSS, Huawei NIP6800 · Huawei Secospace USG6600 +1)
- [CVE-2020-8768](https://cve.now/CVE-2020-8768.md): An issue was discovered on Phoenix Contact Emalytics Controller ILC 2050 BI before 1.2.3 and BI-L before 1.2.3 devices. (no CVSS)
- [CVE-2020-1857](https://cve.now/CVE-2020-1857.md): Huawei NIP6800 versions V500R001C30, V500R001C60SPC500, and V500R005C00SPC100; and Secospace USG6600 and USG9500 versions V500R001C30SPC200, (no CVSS, Huawei NIP6800 · Huawei Secospace USG6600 +1)
- [CVE-2019-19325](https://cve.now/CVE-2019-19325.md): SilverStripe through 4.4.x before 4.4.5 and 4.5.x before 4.5.2 allows Reflected XSS on the login form and custom forms. (no CVSS, silverstripe/framework)
- [CVE-2020-1828](https://cve.now/CVE-2020-1828.md): Huawei NIP6800 versions V500R001C30, V500R001C60SPC500, and V500R005C00; and Secospace USG6600 and USG9500 versions V500R001C30SPC200, V500R (no CVSS, Huawei NIP6800 · Huawei Secospace USG6600 +1)
- [CVE-2020-1693](https://cve.now/CVE-2020-1693.md): A flaw was found in Spacewalk up to version 2.9 where it was vulnerable to XML internal entity attacks via the /rpc/api endpoint. (CVSS 8.6, Red Hat spacewalk)
- [CVE-2020-1858](https://cve.now/CVE-2020-1858.md): Huawei products NIP6800 versions V500R001C30, V500R001C60SPC500, and V500R005C00SPC100; Secospace USG6600 versions V500R001C30SPC600, V500R0 (no CVSS, Huawei NIP6800 · Huawei Secospace USG6600 +1)
- [CVE-2020-7597](https://cve.now/CVE-2020-7597.md): codecov-node npm module before 3.6.5 allows remote attackers to execute arbitrary commands.The value provided as part of the gcov-root argum (no CVSS, codecov npm module · codecov)
- [CVE-2019-18998](https://cve.now/CVE-2019-18998.md): Asset Suite Direct Object Reference Access (CVSS 7.1, ABB Asset Suite)
- [CVE-2019-20474](https://cve.now/CVE-2019-20474.md): An issue was discovered in Zoho ManageEngine Remote Access Plus 10.0.447. (CVSS 4.3)
- [CVE-2013-7324](https://cve.now/CVE-2013-7324.md): Webkit-GTK 2.x (any version with HTML5 audio/video support based on GStreamer) allows remote attackers to trigger unexpectedly high sound vo (no CVSS)
- [CVE-2015-5216](https://cve.now/CVE-2015-5216.md): The Identity Provider (IdP) server in Ipsilon 0.1.0 before 1.0.1 does not properly escape certain characters in a Python exception-message t (no CVSS, Ipsilon)
- [CVE-2015-4715](https://cve.now/CVE-2015-4715.md): The fetch function in OAuth/Curl.php in Dropbox-PHP, as used in ownCloud Server before 6.0.8, 7.x before 7.0.6, and 8.x before 8.0.4 when an (no CVSS)
- [CVE-2015-6922](https://cve.now/CVE-2015-6922.md): Kaseya Virtual System Administrator (VSA) 7.x before 7.0.0.33, 8.x before 8.0.0.23, 9.0 before 9.0.0.19, and 9.1 before 9.1.0.9 does not pro (no CVSS)
- [CVE-2015-0258](https://cve.now/CVE-2015-0258.md): Multiple incomplete blacklist vulnerabilities in the avatar upload functionality in manageuser.php in Collabtive before 2.1 allow remote aut (no CVSS, Collabtive)
- [CVE-2020-9043](https://cve.now/CVE-2020-9043.md): The wpCentral plugin before 1.5.1 for WordPress allows disclosure of the connection key. (no CVSS)
- [CVE-2019-12954](https://cve.now/CVE-2019-12954.md): SolarWinds Network Performance Monitor (Orion Platform 2018, NPM 12.3, NetPath 1.1.3) allows XSS by authenticated users via a crafted onerro (no CVSS)
- [CVE-2020-1704](https://cve.now/CVE-2020-1704.md): An insecure modification vulnerability in the /etc/passwd file was found in all versions of OpenShift ServiceMesh (maistra) before 1.0.8 in (CVSS 7.0, Red Hat openshift-service-mesh/kiali-rhel7-operator)
- [CVE-2013-3722](https://cve.now/CVE-2013-3722.md): A Denial of Service (infinite loop) exists in OpenSIPS before 1.10 in lookup.c. (no CVSS)
- [CVE-2013-3738](https://cve.now/CVE-2013-3738.md): A File Inclusion vulnerability exists in Zabbix 2.0.6 due to inadequate sanitization of request strings in CGI scripts, which could let a re (no CVSS)
- [CVE-2020-9038](https://cve.now/CVE-2020-9038.md): Joplin through 1.0.184 allows Arbitrary File Read via XSS. (no CVSS, joplin)
- [CVE-2020-1692](https://cve.now/CVE-2020-1692.md): Moodle before version 3.7.2 is vulnerable to information exposure of service tokens for users enrolled in the same course. (CVSS 8.1, The Moodle Project moodle · moodle/moodle)
- [CVE-2020-6850](https://cve.now/CVE-2020-6850.md): Utilities.php in the miniorange-saml-20-single-sign-on plugin before 4.8.84 for WordPress allows XSS via a crafted SAML XML Response to wp-l (no CVSS)
- [CVE-2020-8427](https://cve.now/CVE-2020-8427.md): In Unitrends Backup before 10.4.1, an HTTP request parameter was not properly sanitized, allowing for SQL injection that resulted in an auth (no CVSS)
- [CVE-2020-8518](https://cve.now/CVE-2020-8518.md): Horde Groupware Webmail Edition 5.2.22 allows injection of arbitrary PHP code via CSV data, leading to remote code execution. (no CVSS)
- [CVE-2020-8795](https://cve.now/CVE-2020-8795.md): In GitLab Enterprise Edition (EE) 12.5.0 through 12.7.5, sharing a group with a group could grant project access to unauthorized users. (no CVSS)
- [CVE-2020-9006](https://cve.now/CVE-2020-9006.md): The Popup Builder plugin 2.2.8 through 2.6.7.6 for WordPress is vulnerable to SQL injection (in the sgImportPopups function in sg\_popup\_ajax (no CVSS)
- [CVE-2019-12825](https://cve.now/CVE-2019-12825.md): Unauthorized Access to the Container Registry of other groups was discovered in GitLab Enterprise 12.0.0-pre. (no CVSS)
- [CVE-2020-9005](https://cve.now/CVE-2020-9005.md): meshsystem.dll in Valve Dota 2 through 2020-02-17 allows remote attackers to achieve code execution or denial of service by creating a gamin (no CVSS)
- [CVE-2020-5531](https://cve.now/CVE-2020-5531.md): Mitsubishi Electric MELSEC C Controller Module and MELIPC Series MI5000 MELSEC-Q Series C Controller Module(Q24DHCCPU-V, Q24DHCCPU-VG User E (no CVSS, Mitsubishi Electric MELSEC C Controller Module and MELIPC S…)
- [CVE-2020-7252](https://cve.now/CVE-2020-7252.md): Unquoted service executable path (CVSS 4.2, McAfee Data Exchange Layer (DXL) Broker)
- [CVE-2020-9020](https://cve.now/CVE-2020-9020.md): Iteris Vantage Velocity Field Unit 2.3.1, 2.4.2, and 3.0 devices allow the injection of OS commands into cgi-bin/timeconfig.py via shell met (no CVSS)
- [CVE-2020-9021](https://cve.now/CVE-2020-9021.md): Post Oak AWAM Bluetooth Field Device 7400v2.08.21.2018, 7800SD.2015.1.16, 2011.3, 7400v2.02.01.2019, and 7800SD.2012.12.5 is vulnerable to i (no CVSS)
- [CVE-2020-9022](https://cve.now/CVE-2020-9022.md): An issue was discovered on Xirrus XR520, XR620, XR2436, and XH2-120 devices. (no CVSS)
- [CVE-2020-9023](https://cve.now/CVE-2020-9023.md): Iteris Vantage Velocity Field Unit 2.3.1 and 2.4.2 devices have two users that are not documented and are configured with weak passwords (Us (no CVSS)
- [CVE-2020-9024](https://cve.now/CVE-2020-9024.md): Iteris Vantage Velocity Field Unit 2.3.1 and 2.4.2 devices have world-writable permissions for the /root/cleardata.pl (executed as root by c (no CVSS)
- [CVE-2020-9025](https://cve.now/CVE-2020-9025.md): Iteris Vantage Velocity Field Unit 2.4.2 devices have multiple stored XSS issues in all parameters of the Start Data Viewer feature of the / (no CVSS)
- [CVE-2020-9026](https://cve.now/CVE-2020-9026.md): ELTEX NTP-RG-1402G 1v10 3.25.3.32 devices allow OS command injection via the PING field of the resource ping.cmd. (no CVSS)
- [CVE-2020-9027](https://cve.now/CVE-2020-9027.md): ELTEX NTP-RG-1402G 1v10 3.25.3.32 devices allow OS command injection via the TRACE field of the resource ping.cmd. (no CVSS)
- [CVE-2020-9028](https://cve.now/CVE-2020-9028.md): Symmetricom SyncServer S100 2.90.70.3, S200 1.30, S250 1.25, S300 2.65.0, and S350 2.80.1 devices allow stored XSS via the newUserName param (no CVSS)
- [CVE-2020-9029](https://cve.now/CVE-2020-9029.md): Symmetricom SyncServer S100 2.90.70.3, S200 1.30, S250 1.25, S300 2.65.0, and S350 2.80.1 devices allow Directory Traversal via the FileName (no CVSS)
- [CVE-2020-9030](https://cve.now/CVE-2020-9030.md): Symmetricom SyncServer S100 2.90.70.3, S200 1.30, S250 1.25, S300 2.65.0, and S350 2.80.1 devices allow Directory Traversal via the FileName (no CVSS)
- [CVE-2020-9031](https://cve.now/CVE-2020-9031.md): Symmetricom SyncServer S100 2.90.70.3, S200 1.30, S250 1.25, S300 2.65.0, and S350 2.80.1 devices allow Directory Traversal via the FileName (no CVSS)
- [CVE-2020-9032](https://cve.now/CVE-2020-9032.md): Symmetricom SyncServer S100 2.90.70.3, S200 1.30, S250 1.25, S300 2.65.0, and S350 2.80.1 devices allow Directory Traversal via the FileName (no CVSS)
- [CVE-2020-9033](https://cve.now/CVE-2020-9033.md): Symmetricom SyncServer S100 2.90.70.3, S200 1.30, S250 1.25, S300 2.65.0, and S350 2.80.1 devices allow Directory Traversal via the FileName (no CVSS)
- [CVE-2020-9034](https://cve.now/CVE-2020-9034.md): Symmetricom SyncServer S100 2.90.70.3, S200 1.30, S250 1.25, S300 2.65.0, and S350 2.80.1 devices mishandle session validation, leading to u (no CVSS)
- [CVE-2015-5215](https://cve.now/CVE-2015-5215.md): The default configuration of the Jinja templating engine used in the Identity Provider (IdP) server in Ipsilon 0.1.0 before 1.0.1 does not e (no CVSS, Ipsilon)
- [CVE-2019-10790](https://cve.now/CVE-2019-10790.md): taffydb npm module, vulnerable in all versions up to and including 2.7.3, allows attackers to forge adding additional properties into user-i (no CVSS, taffy npm module · taffy +1)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2020-02-17
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.