CVEs published February 18, 2020
54 CVEs were published on February 18, 2020: 2 critical, 0 high. 1 is now in CISA KEV.
- Published
- 54
- Critical
- 2
- High
- 0
- Medium
- 0
- Low
- 0
- Unrated
- 52
- Now in CISA KEV
- 1
- Fix available
- 6
Most affected products
- CA Technologies - A Broadcom Company CA Unified Infrastruct…
- 3
- FreeBSD
- 3
- ansible
- 2
- Libnsgif
- 2
- Apache jclouds
- 1
- Authenticated User Page Caching (Authcache) module
- 1
- Huawei GaussDB
- 1
- Huawei HEGE-560 · Huawei OSCA-550 +3
- 1
- Huawei HEGE-560 · Huawei OSCA-550, OSCA-550A +1
- 1
- Huawei HEGE-570 · Huawei HEGE-560, OSCA-550, OSCA-550A, OSC…
- 1
Critical 2
Medium, low and unrated 52
- CVE-2018-16994An issue was discovered on PHOENIX CONTACT AXL F BK PN <=1.0.4, AXL F BK ETH <= 1.12, and AXL F BK ETH XC <= 1.11 devices and Bosch Rexroth
- CVE-2020-8633An issue was discovered in Zimbra Collaboration Suite (ZCS) before 8.8.15 Patch 7.
- CVE-2013-4226The Authenticated User Page Caching (Authcache) module 7.x-1.x before 7.x-1.5 for Drupal does not properly restrict access to cached pages, Authenticated User Page Caching (Authcache) module
- CVE-2013-4228The OG access fields (visibility fields) implementation in Organic Groups (OG) module 7.x-2.x before 7.x-2.3 for Drupal does not properly reOrganic Groups (OG) module
- CVE-2015-7507libnsbmp.c in Libnsbmp 0.1.2 allows context-dependent attackers to cause a denial of service (out-of-bounds read) via a crafted color table Libnsbmp
- CVE-2015-7505Stack-based buffer overflow in the gif_next_LZW function in libnsgif.c in Libnsgif 0.1.2 allows context-dependent attackers to cause a deniaLibnsgif
- CVE-2015-7567SQL injection vulnerability in Yeager CMS 1.2.1 allows remote attackers to execute arbitrary SQL commands via the "passwordreset&token" paraYeager CMS
- CVE-2020-9266SOPlanning 1.45 is vulnerable to a CSRF attack that allows for arbitrary changing of the admin password via process/xajax_server.php.
- CVE-2020-9267SOPlanning 1.45 is vulnerable to a CSRF attack that allows for arbitrary user creation via process/xajax_server.php.
- CVE-2020-9268SoPlanning 1.45 is vulnerable to SQL Injection in the OrderBy clause, as demonstrated by the projets.php?order=nom_createur&by= substring.
- CVE-2020-9269SOPlanning 1.45 is vulnerable to authenticated SQL Injection that leads to command execution via the users parameter, as demonstrated by exp
- CVE-2020-9270ICE Hrm 26.2.0 is vulnerable to CSRF that leads to password reset via service.php.
- CVE-2020-9271ICE Hrm 26.2.0 is vulnerable to CSRF that leads to user creation via service.php.
- CVE-2012-0718IBM Tivoli Endpoint Manager 8 does not set the HttpOnly flag on cookies.IBM Tivoli Endpoint Manager
- CVE-2014-3879OpenPAM Nummularia 9.2 through 10.0 does not properly handle the error reported when an include directive refers to a policy that does not e
- CVE-2013-2679Multiple cross-site scripting (XSS) vulnerabilities in Cisco Linksys E4200 router with firmware 1.0.05 build 7 allow remote attackers to inj
- CVE-2013-6295PrestaShop 1.5.5 vulnerable to privilege escalation via a Salesman account via upload module
- CVE-2013-3323A Privilege Escalation Vulnerability exists in IBM Maximo Asset Management 7.5, 7.1, and 6.2, when WebSeal with Basic Authentication is used
- CVE-2019-10791promise-probe before 0.10.0 allows remote attackers to perform a command injection attack.Snyk promise-probe · promise-probe
- CVE-2019-10793dot-object before 2.1.3 is vulnerable to Prototype Pollution.Snyk dot-object · dot-object
- CVE-2019-10792bodymen before 1.1.1 is vulnerable to Prototype Pollution.Snyk bodymen · bodymen
- CVE-2019-10795undefsafe before 2.0.3 is vulnerable to Prototype Pollution.Snyk undefsafe · undefsafe
- CVE-2019-10794All versions of component-flatten are vulnerable to Prototype Pollution.Snyk component-flatten · component-flatten
- CVE-2019-15875In FreeBSD 12.1-STABLE before r354734, 12.1-RELEASE before 12.1-RELEASE-p2, 12.0-RELEASE before 12.0-RELEASE-p13, 11.3-STABLE before r354735FreeBSD
- CVE-2019-5613In FreeBSD 12.0-RELEASE before 12.0-RELEASE-p13, a missing check in the ipsec packet processor allows reinjection of an old packet to be accFreeBSD
- CVE-2020-7450In FreeBSD 12.1-STABLE before r357213, 12.1-RELEASE before 12.1-RELEASE-p2, 12.0-RELEASE before 12.0-RELEASE-p13, 11.3-STABLE before r357214FreeBSD
- CVE-2019-18352Improper access control exists on PHOENIX CONTACT FL NAT 2208 devices before V2.90 and FL NAT 2304-2GC-2SFP devices before V2.90 when using
- CVE-2020-9264ESET Archive Support Module before 1296 allows virus-detection bypass via a crafted Compression Information Field in a ZIP archive.
- CVE-2014-4967Multiple argument injection vulnerabilities in Ansible before 1.6.7 allow remote attackers to execute arbitrary code by leveraging access toansible
- CVE-2014-4966Ansible before 1.6.7 does not prevent inventory data with "{{" and "lookup" substrings, and does not prevent remote data with "{{" substringansible
- CVE-2020-6845An issue was discovered in TopManage OLK 2020.
- CVE-2020-6844In TopManage OLK 2020, login CSRF can be chained with another vulnerability in order to takeover admin and user accounts.
- CVE-2013-4227Cross-site request forgery (CSRF) vulnerability in the persona_xsrf_token function in persona.module in the Mozilla Persona module 7.x-1.x bMozilla Persona
- CVE-2015-7506The gif_next_LZW function in libnsgif.c in Libnsgif 0.1.2 allows context-dependent attackers to cause a denial of service (out-of-bounds reaLibnsgif
- CVE-2015-6970The web interface in Bosch Security Systems NBN-498 Dinion2X Day/Night IP Cameras with H.264 Firmware 4.54.0026 allows remote attackers to c
- CVE-2013-4454WordPress Portable phpMyAdmin Plugin 1.4.1 has Multiple Security Bypass VulnerabilitiesPortable phpMyAdmin Plugin authors Portable phpMyAdmin Plug…
- CVE-2014-4651It was found that the jclouds scriptbuilder Statements class wrote a temporary file to a predictable location.Apache jclouds
- CVE-2015-1425JAKWEB Gecko CMS has Multiple Input Validation Vulnerabilities
- CVE-2013-5594Mozilla Firefox before 25 allows modification of anonymous content of pluginProblem.xml bindingMozilla Firefox
- CVE-2020-5530Cross-site request forgery (CSRF) vulnerability in Easy Property Listings versions prior to 3.4 allows remote attackers to hijack the authenMerv Barrett Easy Property Listings
- CVE-2020-8012CA Unified Infrastructure Management (Nimsoft/UIM) 20.1, 20.3.x, and 9.20 and below contains a buffer overflow vulnerability in the robot (cCA Technologies - A Broadcom Company CA Unified Infrastruct…
- CVE-2020-8010CA Unified Infrastructure Management (Nimsoft/UIM) 20.1, 20.3.x, and 9.20 and below contains an improper ACL handling vulnerability in the rCA Technologies - A Broadcom Company CA Unified Infrastruct…
- CVE-2020-8011CA Unified Infrastructure Management (Nimsoft/UIM) 20.1, 20.3.x, and 9.20 and below contains a null pointer dereference vulnerability in theCA Technologies - A Broadcom Company CA Unified Infrastruct…
- CVE-2020-1842Huawei HEGE-560 version 1.0.1.20(SP2); OSCA-550 and OSCA-550A version 1.0.0.71(SP1); and OSCA-550AX and OSCA-550X version 1.0.0.71(SP2) haveHuawei HEGE-560 · Huawei OSCA-550, OSCA-550A +1
- CVE-2020-1789Huawei OSCA-550, OSCA-550A, OSCA-550AX, and OSCA-550X products with version 1.0.1.21(SP3) have an insufficient authentication vulnerability.Huawei OSCA-550, OSCA-550A, OSCA-550AX, OSCA-550X
- CVE-2020-1812HUAWEI P30 smartphones with versions earlier than 10.0.0.173(C00E73R1P11) have an improper authentication vulnerability.HUAWEI P30
- CVE-2020-1855Huawei HEGE-570 version 1.0.1.22(SP3); and HEGE-560, OSCA-550, OSCA-550A, OSCA-550AX, and OSCA-550X version 1.0.1.21(SP3) have an insufficieHuawei HEGE-570 · Huawei HEGE-560, OSCA-550, OSCA-550A, OSC…
- CVE-2020-1843Huawei HEGE-560 version 1.0.1.20(SP2), OSCA-550 version 1.0.0.71(SP1), OSCA-550A version 1.0.0.71(SP1), OSCA-550AX version 1.0.0.71(SP2), anHuawei HEGE-560 · Huawei OSCA-550 +3
- CVE-2020-1790GaussDB 200 with version of 6.5.1 have a command injection vulnerability.Huawei GaussDB
- CVE-2020-1791HUAWEI Mate 20 smartphones with versions earlier than 10.0.0.185(C00E74R3P8) have an improper authorization vulnerability.HUAWEI Mate
- CVE-2020-1814Huawei NIP6800 versions V500R001C30, V500R001C60SPC500, and V500R005C00; Secospace USG6600 and USG9500 versions V500R001C30SPC200, V500R001CHuawei NIP6800 · Huawei Secospace USG6600, USG9500
- CVE-2020-1872Huawei smart phones P10 Plus with versions earlier than 9.1.0.201(C01E75R1P12T8), earlier than 9.1.0.252(C185E2R1P9T8), earlier than 9.1.0.2HUAWEI P10 Plus