CVEs published February 19, 2020
61 CVEs were published on February 19, 2020: 1 critical, 7 high. 1 is now in CISA KEV.
- Published
- 61
- Critical
- 1
- High
- 7
- Medium
- 17
- Low
- 0
- Unrated
- 36
- Now in CISA KEV
- 1
- Fix available
- 7
Most affected products
- IBM DB2 for Linux- UNIX and Windows
- 5
- Cisco Data Center Network Manager
- 3
- VMWare vRealize Operations for Horizon Adapter
- 3
- CoTURN
- 2
- BOINC
- 1
- Cisco AnyConnect Secure Mobility Client
- 1
- Cisco ASA
- 1
- Cisco Cloud Web Security
- 1
- Cisco Email Security Appliance
- 1
- Cisco Finesse
- 1
Critical 1
High 7
- CVE-2019-1950Cisco IOS XE SD-WAN Software Default Credentials VulnerabilityCisco IOS XE SD-WAN Software
- CVE-2020-3112Cisco Data Center Network Manager Privilege Escalation VulnerabilityCisco Data Center Network Manager
- CVE-2020-3114Cisco Data Center Network Manager Cross-Site Request Forgery VulnerabilityCisco Data Center Network Manager
- CVE-2020-6061An exploitable heap out-of-bounds read vulnerability exists in the way CoTURN 4.5.1.1 web server parses POST requests.CoTURN
- CVE-2019-17333TIBCO EBX Exposes Cross-Site Scripting VulnerabilityTIBCO Software TIBCO EBX
- CVE-2020-4204IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, 11.1, and 11.5 is vulnerable to a buffer overflow, causedIBM DB2 for Linux- UNIX and Windows
- CVE-2020-4135IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, 11.1, and 11.5 could allow an unauthenticated user to senIBM DB2 for Linux- UNIX and Windows
Medium, low and unrated 53
- CVE-2013-2018Multiple SQL injection vulnerabilities in BOINC allow remote attackers to execute arbitrary SQL commands via unspecified vectors.BOINC
- CVE-2020-7942Previously, Puppet operated on a model that a node with a valid certificate was entitled to all information in the system and that a compromPuppet
- CVE-2015-7747Buffer overflow in the afReadFrames function in audiofile (aka libaudiofile and Audio File Library) allows user-assisted remote attackers to
- CVE-2020-6970A Heap-based Buffer Overflow was found in Emerson OpenEnterprise SCADA Server 2.83 (if Modbus or ROC Interfaces have been installed and are Emerson OpenEnterprise SCADA Server · Emerson OpenEnterprise
- CVE-2020-3943vRealize Operations for Horizon Adapter (6.7.x prior to 6.7.1 and 6.6.x prior to 6.6.1) uses a JMX RMI service which is not securely configuVMWare vRealize Operations for Horizon Adapter
- CVE-2020-3944vRealize Operations for Horizon Adapter (6.7.x prior to 6.7.1 and 6.6.x prior to 6.6.1) has an improper trust store configuration leading toVMWare vRealize Operations for Horizon Adapter
- CVE-2020-3945vRealize Operations for Horizon Adapter (6.7.x prior to 6.7.1 and 6.6.x prior to 6.6.1) contains an information disclosure vulnerability dueVMWare vRealize Operations for Horizon Adapter
- CVE-2014-9617Open redirect vulnerability in remotereporter/load_logfiles.php in Netsweeper before 4.0.5 allows remote attackers to redirect users to arbi
- CVE-2014-9615Cross-site scripting (XSS) vulnerability in Netsweeper 4.0.4 allows remote attackers to inject arbitrary web script or HTML via the url para
- CVE-2014-9614The Web Panel in Netsweeper before 4.0.5 has a default password of branding for the branding account, which makes it easier for remote attac
- CVE-2014-9613Multiple SQL injection vulnerabilities in Netsweeper before 2.6.29.10 allow remote attackers to execute arbitrary SQL commands via the (1) l
- CVE-2014-9612SQL injection vulnerability in remotereporter/load_logfiles.php in Netsweeper before 3.1.10, 4.0.x before 4.0.9, and 4.1.x before 4.1.2 allo
- CVE-2014-9609Directory traversal vulnerability in webadmin/reporter/view_server_log.php in Netsweeper before 3.1.10, 4.0.x before 4.0.9, and 4.1.x before
- CVE-2014-9608Cross-site scripting (XSS) vulnerability in webadmin/policy/group_table_ajax.php/ in Netsweeper before 3.1.10, 4.0.x before 4.0.9, and 4.1.x
- CVE-2014-9607Cross-site scripting (XSS) vulnerability in remotereporter/load_logfiles.php in Netsweeper 4.0.3 and 4.0.4 allows remote attackers to inject
- CVE-2014-9606Multiple cross-site scripting (XSS) vulnerabilities in Netsweeper before 3.1.10, 4.0.x before 4.0.9, and 4.1.x before 4.1.2 allow remote att
- CVE-2020-3113Cisco Data Center Network Manager Stored Cross-Site Scripting VulnerabilityCisco Data Center Network Manager
- CVE-2020-3132Cisco Email Security Appliance Shortened URL Denial of Service VulnerabilityCisco Email Security Appliance
- CVE-2020-3138Cisco Enterprise NFV Infrastructure Software Remote Code Execution Vulnerability
- CVE-2020-3153Cisco AnyConnect Secure Mobility Client for Windows Uncontrolled Search Path VulnerabilityCisco AnyConnect Secure Mobility Client
- CVE-2020-3154Cisco Cloud Web Security SQL Injection VulnerabilityCisco Cloud Web Security
- CVE-2020-3156Cisco Identity Services Engine Cross-Site Scripting VulnerabilityCisco Identity Services Engine Software
- CVE-2020-3159Cisco Finesse Web-Based Management Interface Cross-Site Scripting VulnerabilityCisco Finesse
- CVE-2020-3160Cisco Meeting Server Extensible Messaging and Presence Protocol Denial of Service VulnerabilityCisco Meeting Server
- CVE-2020-3163Cisco Unified Contact Center Enterprise Denial of Service VulnerabilityCisco Unified Contact Center Enterprise
- CVE-2020-6062An exploitable denial-of-service vulnerability exists in the way CoTURN 4.5.1.1 web server parses POST requests.CoTURN
- CVE-2019-10797Netty in WSO2 transport-http before v6.3.1 is vulnerable to HTTP Response Splitting due to HTTP Header validation being disabled.Snyk WSO2 transport-http · org.wso2.transport.http:org.wso2…
- CVE-2012-0055OverlayFS in the Linux kernel before 3.0.0-16.28, as used in Ubuntu 10.0.4 LTS and 11.10, is missing inode security checks which could allowLinux kernel OverlayFS
- CVE-2019-12246SilverStripe through 4.3.3 allows a Denial of Service on flush and development URL tools.silverstripe/framework
- CVE-2019-12437In SilverStripe through 4.3.3, the previous fix for SS-2018-007 does not completely mitigate the risk of CSRF in GraphQL mutations,silverstripe/graphql
- CVE-2020-8441JYaml through 1.3 allows remote code execution during deserialization of a malicious payload through the load() function.org.jyaml:jyaml
- CVE-2020-8959Western Digital WesternDigitalSSDDashboardSetup.exe before 3.0.2.0 allows DLL Hijacking.
- CVE-2020-8824Hitron CODA-4582U 7.1.1.30 devices allow XSS via a Managed Device name on the Wireless > Access Control > Add Managed Device screen.
- CVE-2020-4230IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 11.1 and 11.5 is vulnerable to an escalation of privilege when an authentiIBM DB2 for Linux- UNIX and Windows
- CVE-2020-4200IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 10.5, 11.1, and 11.5 could allow an authenticated attacker to send specialIBM DB2 for Linux- UNIX and Windows
- CVE-2020-4161IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 11.5 could allow an authenticated attacker to cause a denial of service duIBM DB2 for Linux- UNIX and Windows
- CVE-2019-4640IBM Security Secret Server 10.7 processes patches, image backups and other updates without sufficiently verifying the origin and integrity oIBM Security Secret Server
- CVE-2019-4457IBM Jazz Foundation 6.0, 6.0.1, 6.0.2, 6.0.3, 6.0.4, 6.0.5, 6.0.6, and 6.0.6.1 could allow an authenticated user to obtain sensitive informaIBM Rational Rhapsody Design Manager
- CVE-2019-4429IBM Maximo Asset Management 7.6.0 and 7.6.1 is vulnerable to cross-site scripting.IBM Maximo Asset Management
- CVE-2012-6685Nokogiri before 1.5.4 is vulnerable to XXE attacksnokogiri
- CVE-2012-1932A cross-site scripting (XSS) vulnerability in Wolf CMS 0.75 and earlier allows remote attackers to inject arbitrary web script or HTML via t
- CVE-2012-6614D-Link DSR-250N devices before 1.08B31 allow remote authenticated users to obtain "persistent root access" via the BusyBox CLI, as demonstra
- CVE-2014-2727The STARTTLS implementation in MailMarshal before 7.2 allows plaintext command injection.
- CVE-2014-2228The XStream extension in HP Fortify SCA before 2.2 RC3 allows remote attackers to execute arbitrary code via unsafe deserialization of XML m
- CVE-2014-3622Use-after-free vulnerability in the add_post_var function in the Posthandler component in PHP 5.6.x before 5.6.1 might allow remote attackerPHP
- CVE-2016-1000109HHVM does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect CGI applications from the presen
- CVE-2016-1000005mcrypt_get_block_size did not enforce that the provided "module" parameter was a string, leading to type confusion if other types of data we
- CVE-2016-1000004Insufficient type checks were employed prior to casting input data in SimpleXMLElement_exportNode and simplexml_import_dom.
- CVE-2019-20477PyYAML 5.1 through 5.1.2 has insufficient restrictions on the load and load_all functions because of a class deserialization issue, e.g., Popyyaml
- CVE-2019-20478In ruamel.yaml through 0.16.7, the load method allows remote code execution if the application calls this method with an untrusted argument.
- CVE-2011-2054Cisco ASA Secondary Authentication Bypass VulnerabilityCisco ASA
- CVE-2015-0749Cisco Unified Communications Manager Cross-Site Scripting VulnerabilityCisco Unified Communications Manager
- CVE-2015-9543An issue was discovered in OpenStack Nova before 18.2.4, 19.x before 19.1.0, and 20.x before 20.1.0.nova