# CVEs published 2020-02-18

54 CVEs were published on February 18, 2020: 2 critical, 0 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2018-16994](https://cve.now/CVE-2018-16994.md): An issue was discovered on PHOENIX CONTACT AXL F BK PN \<=1.0.4, AXL F BK ETH \<= 1.12, and AXL F BK ETH XC \<= 1.11 devices and Bosch Rexroth (no CVSS)
- [CVE-2020-8633](https://cve.now/CVE-2020-8633.md): An issue was discovered in Zimbra Collaboration Suite (ZCS) before 8.8.15 Patch 7. (no CVSS)
- [CVE-2020-7796](https://cve.now/CVE-2020-7796.md): Zimbra Collaboration Suite (ZCS) before 8.8.15 Patch 7 allows SSRF when WebEx zimlet is installed and zimlet JSP is enabled. (CVSS 9.8, KEV)
- [CVE-2013-4226](https://cve.now/CVE-2013-4226.md): The Authenticated User Page Caching (Authcache) module 7.x-1.x before 7.x-1.5 for Drupal does not properly restrict access to cached pages, (no CVSS, Authenticated User Page Caching (Authcache) module)
- [CVE-2013-4228](https://cve.now/CVE-2013-4228.md): The OG access fields (visibility fields) implementation in Organic Groups (OG) module 7.x-2.x before 7.x-2.3 for Drupal does not properly re (no CVSS, Organic Groups (OG) module)
- [CVE-2015-7507](https://cve.now/CVE-2015-7507.md): libnsbmp.c in Libnsbmp 0.1.2 allows context-dependent attackers to cause a denial of service (out-of-bounds read) via a crafted color table (no CVSS, Libnsbmp)
- [CVE-2015-7505](https://cve.now/CVE-2015-7505.md): Stack-based buffer overflow in the gif\_next\_LZW function in libnsgif.c in Libnsgif 0.1.2 allows context-dependent attackers to cause a denia (no CVSS, Libnsgif)
- [CVE-2015-7567](https://cve.now/CVE-2015-7567.md): SQL injection vulnerability in Yeager CMS 1.2.1 allows remote attackers to execute arbitrary SQL commands via the "passwordreset&token" para (no CVSS, Yeager CMS)
- [CVE-2020-9265](https://cve.now/CVE-2020-9265.md): phpMyChat-Plus 1.98 is vulnerable to multiple SQL injections against the deluser.php Delete User functionality, as demonstrated by pmc\_usern (CVSS 9.3)
- [CVE-2020-9266](https://cve.now/CVE-2020-9266.md): SOPlanning 1.45 is vulnerable to a CSRF attack that allows for arbitrary changing of the admin password via process/xajax\_server.php. (no CVSS)
- [CVE-2020-9267](https://cve.now/CVE-2020-9267.md): SOPlanning 1.45 is vulnerable to a CSRF attack that allows for arbitrary user creation via process/xajax\_server.php. (no CVSS)
- [CVE-2020-9268](https://cve.now/CVE-2020-9268.md): SoPlanning 1.45 is vulnerable to SQL Injection in the OrderBy clause, as demonstrated by the projets.php?order=nom\_createur&by= substring. (no CVSS)
- [CVE-2020-9269](https://cve.now/CVE-2020-9269.md): SOPlanning 1.45 is vulnerable to authenticated SQL Injection that leads to command execution via the users parameter, as demonstrated by exp (no CVSS)
- [CVE-2020-9270](https://cve.now/CVE-2020-9270.md): ICE Hrm 26.2.0 is vulnerable to CSRF that leads to password reset via service.php. (no CVSS)
- [CVE-2020-9271](https://cve.now/CVE-2020-9271.md): ICE Hrm 26.2.0 is vulnerable to CSRF that leads to user creation via service.php. (no CVSS)
- [CVE-2012-0718](https://cve.now/CVE-2012-0718.md): IBM Tivoli Endpoint Manager 8 does not set the HttpOnly flag on cookies. (no CVSS, IBM Tivoli Endpoint Manager)
- [CVE-2014-3879](https://cve.now/CVE-2014-3879.md): OpenPAM Nummularia 9.2 through 10.0 does not properly handle the error reported when an include directive refers to a policy that does not e (no CVSS)
- [CVE-2013-2679](https://cve.now/CVE-2013-2679.md): Multiple cross-site scripting (XSS) vulnerabilities in Cisco Linksys E4200 router with firmware 1.0.05 build 7 allow remote attackers to inj (no CVSS)
- [CVE-2013-6295](https://cve.now/CVE-2013-6295.md): PrestaShop 1.5.5 vulnerable to privilege escalation via a Salesman account via upload module (no CVSS)
- [CVE-2013-3323](https://cve.now/CVE-2013-3323.md): A Privilege Escalation Vulnerability exists in IBM Maximo Asset Management 7.5, 7.1, and 6.2, when WebSeal with Basic Authentication is used (no CVSS)
- [CVE-2019-10791](https://cve.now/CVE-2019-10791.md): promise-probe before 0.10.0 allows remote attackers to perform a command injection attack. (no CVSS, Snyk promise-probe · promise-probe)
- [CVE-2019-10793](https://cve.now/CVE-2019-10793.md): dot-object before 2.1.3 is vulnerable to Prototype Pollution. (no CVSS, Snyk dot-object · dot-object)
- [CVE-2019-10792](https://cve.now/CVE-2019-10792.md): bodymen before 1.1.1 is vulnerable to Prototype Pollution. (no CVSS, Snyk bodymen · bodymen)
- [CVE-2019-10795](https://cve.now/CVE-2019-10795.md): undefsafe before 2.0.3 is vulnerable to Prototype Pollution. (no CVSS, Snyk undefsafe · undefsafe)
- [CVE-2019-10794](https://cve.now/CVE-2019-10794.md): All versions of component-flatten are vulnerable to Prototype Pollution. (no CVSS, Snyk component-flatten · component-flatten)
- [CVE-2019-15875](https://cve.now/CVE-2019-15875.md): In FreeBSD 12.1-STABLE before r354734, 12.1-RELEASE before 12.1-RELEASE-p2, 12.0-RELEASE before 12.0-RELEASE-p13, 11.3-STABLE before r354735 (no CVSS, FreeBSD)
- [CVE-2019-5613](https://cve.now/CVE-2019-5613.md): In FreeBSD 12.0-RELEASE before 12.0-RELEASE-p13, a missing check in the ipsec packet processor allows reinjection of an old packet to be acc (no CVSS, FreeBSD)
- [CVE-2020-7450](https://cve.now/CVE-2020-7450.md): In FreeBSD 12.1-STABLE before r357213, 12.1-RELEASE before 12.1-RELEASE-p2, 12.0-RELEASE before 12.0-RELEASE-p13, 11.3-STABLE before r357214 (no CVSS, FreeBSD)
- [CVE-2019-18352](https://cve.now/CVE-2019-18352.md): Improper access control exists on PHOENIX CONTACT FL NAT 2208 devices before V2.90 and FL NAT 2304-2GC-2SFP devices before V2.90 when using (no CVSS)
- [CVE-2020-9264](https://cve.now/CVE-2020-9264.md): ESET Archive Support Module before 1296 allows virus-detection bypass via a crafted Compression Information Field in a ZIP archive. (no CVSS)
- [CVE-2014-4967](https://cve.now/CVE-2014-4967.md): Multiple argument injection vulnerabilities in Ansible before 1.6.7 allow remote attackers to execute arbitrary code by leveraging access to (no CVSS, ansible)
- [CVE-2014-4966](https://cve.now/CVE-2014-4966.md): Ansible before 1.6.7 does not prevent inventory data with "{{" and "lookup" substrings, and does not prevent remote data with "{{" substring (no CVSS, ansible)
- [CVE-2020-6845](https://cve.now/CVE-2020-6845.md): An issue was discovered in TopManage OLK 2020. (no CVSS)
- [CVE-2020-6844](https://cve.now/CVE-2020-6844.md): In TopManage OLK 2020, login CSRF can be chained with another vulnerability in order to takeover admin and user accounts. (no CVSS)
- [CVE-2013-4227](https://cve.now/CVE-2013-4227.md): Cross-site request forgery (CSRF) vulnerability in the persona\_xsrf\_token function in persona.module in the Mozilla Persona module 7.x-1.x b (no CVSS, Mozilla Persona)
- [CVE-2015-7506](https://cve.now/CVE-2015-7506.md): The gif\_next\_LZW function in libnsgif.c in Libnsgif 0.1.2 allows context-dependent attackers to cause a denial of service (out-of-bounds rea (no CVSS, Libnsgif)
- [CVE-2015-6970](https://cve.now/CVE-2015-6970.md): The web interface in Bosch Security Systems NBN-498 Dinion2X Day/Night IP Cameras with H.264 Firmware 4.54.0026 allows remote attackers to c (no CVSS)
- [CVE-2013-4454](https://cve.now/CVE-2013-4454.md): WordPress Portable phpMyAdmin Plugin 1.4.1 has Multiple Security Bypass Vulnerabilities (no CVSS, Portable phpMyAdmin Plugin authors Portable phpMyAdmin Plug…)
- [CVE-2014-4651](https://cve.now/CVE-2014-4651.md): It was found that the jclouds scriptbuilder Statements class wrote a temporary file to a predictable location. (no CVSS, Apache jclouds)
- [CVE-2015-1425](https://cve.now/CVE-2015-1425.md): JAKWEB Gecko CMS has Multiple Input Validation Vulnerabilities (no CVSS)
- [CVE-2013-5594](https://cve.now/CVE-2013-5594.md): Mozilla Firefox before 25 allows modification of anonymous content of pluginProblem.xml binding (no CVSS, Mozilla Firefox)
- [CVE-2020-5530](https://cve.now/CVE-2020-5530.md): Cross-site request forgery (CSRF) vulnerability in Easy Property Listings versions prior to 3.4 allows remote attackers to hijack the authen (no CVSS, Merv Barrett Easy Property Listings)
- [CVE-2020-8012](https://cve.now/CVE-2020-8012.md): CA Unified Infrastructure Management (Nimsoft/UIM) 20.1, 20.3.x, and 9.20 and below contains a buffer overflow vulnerability in the robot (c (no CVSS, CA Technologies - A Broadcom Company CA Unified Infrastruct…)
- [CVE-2020-8010](https://cve.now/CVE-2020-8010.md): CA Unified Infrastructure Management (Nimsoft/UIM) 20.1, 20.3.x, and 9.20 and below contains an improper ACL handling vulnerability in the r (no CVSS, CA Technologies - A Broadcom Company CA Unified Infrastruct…)
- [CVE-2020-8011](https://cve.now/CVE-2020-8011.md): CA Unified Infrastructure Management (Nimsoft/UIM) 20.1, 20.3.x, and 9.20 and below contains a null pointer dereference vulnerability in the (no CVSS, CA Technologies - A Broadcom Company CA Unified Infrastruct…)
- [CVE-2020-1842](https://cve.now/CVE-2020-1842.md): Huawei HEGE-560 version 1.0.1.20(SP2); OSCA-550 and OSCA-550A version 1.0.0.71(SP1); and OSCA-550AX and OSCA-550X version 1.0.0.71(SP2) have (no CVSS, Huawei HEGE-560 · Huawei OSCA-550, OSCA-550A +1)
- [CVE-2020-1789](https://cve.now/CVE-2020-1789.md): Huawei OSCA-550, OSCA-550A, OSCA-550AX, and OSCA-550X products with version 1.0.1.21(SP3) have an insufficient authentication vulnerability. (no CVSS, Huawei OSCA-550, OSCA-550A, OSCA-550AX, OSCA-550X)
- [CVE-2020-1812](https://cve.now/CVE-2020-1812.md): HUAWEI P30 smartphones with versions earlier than 10.0.0.173(C00E73R1P11) have an improper authentication vulnerability. (no CVSS, HUAWEI P30)
- [CVE-2020-1855](https://cve.now/CVE-2020-1855.md): Huawei HEGE-570 version 1.0.1.22(SP3); and HEGE-560, OSCA-550, OSCA-550A, OSCA-550AX, and OSCA-550X version 1.0.1.21(SP3) have an insufficie (no CVSS, Huawei HEGE-570 · Huawei HEGE-560, OSCA-550, OSCA-550A, OSC…)
- [CVE-2020-1843](https://cve.now/CVE-2020-1843.md): Huawei HEGE-560 version 1.0.1.20(SP2), OSCA-550 version 1.0.0.71(SP1), OSCA-550A version 1.0.0.71(SP1), OSCA-550AX version 1.0.0.71(SP2), an (no CVSS, Huawei HEGE-560 · Huawei OSCA-550 +3)
- [CVE-2020-1790](https://cve.now/CVE-2020-1790.md): GaussDB 200 with version of 6.5.1 have a command injection vulnerability. (no CVSS, Huawei GaussDB)
- [CVE-2020-1791](https://cve.now/CVE-2020-1791.md): HUAWEI Mate 20 smartphones with versions earlier than 10.0.0.185(C00E74R3P8) have an improper authorization vulnerability. (no CVSS, HUAWEI Mate)
- [CVE-2020-1814](https://cve.now/CVE-2020-1814.md): Huawei NIP6800 versions V500R001C30, V500R001C60SPC500, and V500R005C00; Secospace USG6600 and USG9500 versions V500R001C30SPC200, V500R001C (no CVSS, Huawei NIP6800 · Huawei Secospace USG6600, USG9500)
- [CVE-2020-1872](https://cve.now/CVE-2020-1872.md): Huawei smart phones P10 Plus with versions earlier than 9.1.0.201(C01E75R1P12T8), earlier than 9.1.0.252(C185E2R1P9T8), earlier than 9.1.0.2 (no CVSS, HUAWEI P10 Plus)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2020-02-18
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.