# CVEs published 2020-02-19

61 CVEs were published on February 19, 2020: 1 critical, 7 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2013-2018](https://cve.now/CVE-2013-2018.md): Multiple SQL injection vulnerabilities in BOINC allow remote attackers to execute arbitrary SQL commands via unspecified vectors. (no CVSS, BOINC)
- [CVE-2020-7942](https://cve.now/CVE-2020-7942.md): Previously, Puppet operated on a model that a node with a valid certificate was entitled to all information in the system and that a comprom (no CVSS, Puppet)
- [CVE-2015-7747](https://cve.now/CVE-2015-7747.md): Buffer overflow in the afReadFrames function in audiofile (aka libaudiofile and Audio File Library) allows user-assisted remote attackers to (no CVSS)
- [CVE-2020-6970](https://cve.now/CVE-2020-6970.md): A Heap-based Buffer Overflow was found in Emerson OpenEnterprise SCADA Server 2.83 (if Modbus or ROC Interfaces have been installed and are (no CVSS, Emerson OpenEnterprise SCADA Server · Emerson OpenEnterprise)
- [CVE-2020-3943](https://cve.now/CVE-2020-3943.md): vRealize Operations for Horizon Adapter (6.7.x prior to 6.7.1 and 6.6.x prior to 6.6.1) uses a JMX RMI service which is not securely configu (no CVSS, VMWare vRealize Operations for Horizon Adapter)
- [CVE-2020-3944](https://cve.now/CVE-2020-3944.md): vRealize Operations for Horizon Adapter (6.7.x prior to 6.7.1 and 6.6.x prior to 6.6.1) has an improper trust store configuration leading to (no CVSS, VMWare vRealize Operations for Horizon Adapter)
- [CVE-2020-3945](https://cve.now/CVE-2020-3945.md): vRealize Operations for Horizon Adapter (6.7.x prior to 6.7.1 and 6.6.x prior to 6.6.1) contains an information disclosure vulnerability due (no CVSS, VMWare vRealize Operations for Horizon Adapter)
- [CVE-2014-9617](https://cve.now/CVE-2014-9617.md): Open redirect vulnerability in remotereporter/load\_logfiles.php in Netsweeper before 4.0.5 allows remote attackers to redirect users to arbi (no CVSS)
- [CVE-2014-9615](https://cve.now/CVE-2014-9615.md): Cross-site scripting (XSS) vulnerability in Netsweeper 4.0.4 allows remote attackers to inject arbitrary web script or HTML via the url para (no CVSS)
- [CVE-2014-9614](https://cve.now/CVE-2014-9614.md): The Web Panel in Netsweeper before 4.0.5 has a default password of branding for the branding account, which makes it easier for remote attac (no CVSS)
- [CVE-2019-1950](https://cve.now/CVE-2019-1950.md): Cisco IOS XE SD-WAN Software Default Credentials Vulnerability (CVSS 8.4, Cisco IOS XE SD-WAN Software)
- [CVE-2014-9613](https://cve.now/CVE-2014-9613.md): Multiple SQL injection vulnerabilities in Netsweeper before 2.6.29.10 allow remote attackers to execute arbitrary SQL commands via the (1) l (no CVSS)
- [CVE-2014-9612](https://cve.now/CVE-2014-9612.md): SQL injection vulnerability in remotereporter/load\_logfiles.php in Netsweeper before 3.1.10, 4.0.x before 4.0.9, and 4.1.x before 4.1.2 allo (no CVSS)
- [CVE-2014-9609](https://cve.now/CVE-2014-9609.md): Directory traversal vulnerability in webadmin/reporter/view\_server\_log.php in Netsweeper before 3.1.10, 4.0.x before 4.0.9, and 4.1.x before (no CVSS)
- [CVE-2014-9608](https://cve.now/CVE-2014-9608.md): Cross-site scripting (XSS) vulnerability in webadmin/policy/group\_table\_ajax.php/ in Netsweeper before 3.1.10, 4.0.x before 4.0.9, and 4.1.x (no CVSS)
- [CVE-2014-9607](https://cve.now/CVE-2014-9607.md): Cross-site scripting (XSS) vulnerability in remotereporter/load\_logfiles.php in Netsweeper 4.0.3 and 4.0.4 allows remote attackers to inject (no CVSS)
- [CVE-2014-9606](https://cve.now/CVE-2014-9606.md): Multiple cross-site scripting (XSS) vulnerabilities in Netsweeper before 3.1.10, 4.0.x before 4.0.9, and 4.1.x before 4.1.2 allow remote att (no CVSS)
- [CVE-2020-3113](https://cve.now/CVE-2020-3113.md): Cisco Data Center Network Manager Stored Cross-Site Scripting Vulnerability (CVSS 4.8, Cisco Data Center Network Manager)
- [CVE-2020-3112](https://cve.now/CVE-2020-3112.md): Cisco Data Center Network Manager Privilege Escalation Vulnerability (CVSS 8.8, Cisco Data Center Network Manager)
- [CVE-2020-3114](https://cve.now/CVE-2020-3114.md): Cisco Data Center Network Manager Cross-Site Request Forgery Vulnerability (CVSS 8.8, Cisco Data Center Network Manager)
- [CVE-2020-3132](https://cve.now/CVE-2020-3132.md): Cisco Email Security Appliance Shortened URL Denial of Service Vulnerability (CVSS 6.8, Cisco Email Security Appliance)
- [CVE-2020-3138](https://cve.now/CVE-2020-3138.md): Cisco Enterprise NFV Infrastructure Software Remote Code Execution Vulnerability (no CVSS)
- [CVE-2020-3153](https://cve.now/CVE-2020-3153.md): Cisco AnyConnect Secure Mobility Client for Windows Uncontrolled Search Path Vulnerability (CVSS 6.5, KEV, Cisco AnyConnect Secure Mobility Client)
- [CVE-2020-3154](https://cve.now/CVE-2020-3154.md): Cisco Cloud Web Security SQL Injection Vulnerability (CVSS 4.9, Cisco Cloud Web Security)
- [CVE-2020-3156](https://cve.now/CVE-2020-3156.md): Cisco Identity Services Engine Cross-Site Scripting Vulnerability (CVSS 6.1, Cisco Identity Services Engine Software)
- [CVE-2020-3158](https://cve.now/CVE-2020-3158.md): Cisco Smart Software Manager On-Prem Static Default Credential Vulnerability (CVSS 9.8, Cisco Smart Software Manager On-Prem)
- [CVE-2020-3159](https://cve.now/CVE-2020-3159.md): Cisco Finesse Web-Based Management Interface Cross-Site Scripting Vulnerability (CVSS 6.1, Cisco Finesse)
- [CVE-2020-3160](https://cve.now/CVE-2020-3160.md): Cisco Meeting Server Extensible Messaging and Presence Protocol Denial of Service Vulnerability (CVSS 5.3, Cisco Meeting Server)
- [CVE-2020-3163](https://cve.now/CVE-2020-3163.md): Cisco Unified Contact Center Enterprise Denial of Service Vulnerability (CVSS 6.8, Cisco Unified Contact Center Enterprise)
- [CVE-2020-6061](https://cve.now/CVE-2020-6061.md): An exploitable heap out-of-bounds read vulnerability exists in the way CoTURN 4.5.1.1 web server parses POST requests. (CVSS 7.0, CoTURN)
- [CVE-2020-6062](https://cve.now/CVE-2020-6062.md): An exploitable denial-of-service vulnerability exists in the way CoTURN 4.5.1.1 web server parses POST requests. (CVSS 5.9, CoTURN)
- [CVE-2019-17333](https://cve.now/CVE-2019-17333.md): TIBCO EBX Exposes Cross-Site Scripting Vulnerability (CVSS 8.0, TIBCO Software TIBCO EBX)
- [CVE-2019-10797](https://cve.now/CVE-2019-10797.md): Netty in WSO2 transport-http before v6.3.1 is vulnerable to HTTP Response Splitting due to HTTP Header validation being disabled. (no CVSS, Snyk WSO2 transport-http · org.wso2.transport.http:org.wso2…)
- [CVE-2012-0055](https://cve.now/CVE-2012-0055.md): OverlayFS in the Linux kernel before 3.0.0-16.28, as used in Ubuntu 10.0.4 LTS and 11.10, is missing inode security checks which could allow (no CVSS, Linux kernel OverlayFS)
- [CVE-2019-12246](https://cve.now/CVE-2019-12246.md): SilverStripe through 4.3.3 allows a Denial of Service on flush and development URL tools. (no CVSS, silverstripe/framework)
- [CVE-2019-12437](https://cve.now/CVE-2019-12437.md): In SilverStripe through 4.3.3, the previous fix for SS-2018-007 does not completely mitigate the risk of CSRF in GraphQL mutations, (no CVSS, silverstripe/graphql)
- [CVE-2020-8441](https://cve.now/CVE-2020-8441.md): JYaml through 1.3 allows remote code execution during deserialization of a malicious payload through the load() function. (no CVSS, org.jyaml:jyaml)
- [CVE-2020-8959](https://cve.now/CVE-2020-8959.md): Western Digital WesternDigitalSSDDashboardSetup.exe before 3.0.2.0 allows DLL Hijacking. (no CVSS)
- [CVE-2020-8824](https://cve.now/CVE-2020-8824.md): Hitron CODA-4582U 7.1.1.30 devices allow XSS via a Managed Device name on the Wireless \> Access Control \> Add Managed Device screen. (no CVSS)
- [CVE-2020-4230](https://cve.now/CVE-2020-4230.md): IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 11.1 and 11.5 is vulnerable to an escalation of privilege when an authenti (CVSS 6.7, IBM DB2 for Linux- UNIX and Windows)
- [CVE-2020-4204](https://cve.now/CVE-2020-4204.md): IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, 11.1, and 11.5 is vulnerable to a buffer overflow, caused (CVSS 8.4, IBM DB2 for Linux- UNIX and Windows)
- [CVE-2020-4200](https://cve.now/CVE-2020-4200.md): IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 10.5, 11.1, and 11.5 could allow an authenticated attacker to send special (CVSS 6.5, IBM DB2 for Linux- UNIX and Windows)
- [CVE-2020-4161](https://cve.now/CVE-2020-4161.md): IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 11.5 could allow an authenticated attacker to cause a denial of service du (CVSS 6.5, IBM DB2 for Linux- UNIX and Windows)
- [CVE-2020-4135](https://cve.now/CVE-2020-4135.md): IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, 11.1, and 11.5 could allow an unauthenticated user to sen (CVSS 7.5, IBM DB2 for Linux- UNIX and Windows)
- [CVE-2019-4640](https://cve.now/CVE-2019-4640.md): IBM Security Secret Server 10.7 processes patches, image backups and other updates without sufficiently verifying the origin and integrity o (CVSS 4.4, IBM Security Secret Server)
- [CVE-2019-4457](https://cve.now/CVE-2019-4457.md): IBM Jazz Foundation 6.0, 6.0.1, 6.0.2, 6.0.3, 6.0.4, 6.0.5, 6.0.6, and 6.0.6.1 could allow an authenticated user to obtain sensitive informa (CVSS 4.3, IBM Rational Rhapsody Design Manager)
- [CVE-2019-4429](https://cve.now/CVE-2019-4429.md): IBM Maximo Asset Management 7.6.0 and 7.6.1 is vulnerable to cross-site scripting. (CVSS 5.4, IBM Maximo Asset Management)
- [CVE-2012-6685](https://cve.now/CVE-2012-6685.md): Nokogiri before 1.5.4 is vulnerable to XXE attacks (no CVSS, nokogiri)
- [CVE-2012-1932](https://cve.now/CVE-2012-1932.md): A cross-site scripting (XSS) vulnerability in Wolf CMS 0.75 and earlier allows remote attackers to inject arbitrary web script or HTML via t (no CVSS)
- [CVE-2012-6614](https://cve.now/CVE-2012-6614.md): D-Link DSR-250N devices before 1.08B31 allow remote authenticated users to obtain "persistent root access" via the BusyBox CLI, as demonstra (no CVSS)
- [CVE-2014-2727](https://cve.now/CVE-2014-2727.md): The STARTTLS implementation in MailMarshal before 7.2 allows plaintext command injection. (no CVSS)
- [CVE-2014-2228](https://cve.now/CVE-2014-2228.md): The XStream extension in HP Fortify SCA before 2.2 RC3 allows remote attackers to execute arbitrary code via unsafe deserialization of XML m (no CVSS)
- [CVE-2014-3622](https://cve.now/CVE-2014-3622.md): Use-after-free vulnerability in the add\_post\_var function in the Posthandler component in PHP 5.6.x before 5.6.1 might allow remote attacker (no CVSS, PHP)
- [CVE-2016-1000109](https://cve.now/CVE-2016-1000109.md): HHVM does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect CGI applications from the presen (no CVSS)
- [CVE-2016-1000005](https://cve.now/CVE-2016-1000005.md): mcrypt\_get\_block\_size did not enforce that the provided "module" parameter was a string, leading to type confusion if other types of data we (no CVSS)
- [CVE-2016-1000004](https://cve.now/CVE-2016-1000004.md): Insufficient type checks were employed prior to casting input data in SimpleXMLElement\_exportNode and simplexml\_import\_dom. (no CVSS)
- [CVE-2019-20477](https://cve.now/CVE-2019-20477.md): PyYAML 5.1 through 5.1.2 has insufficient restrictions on the load and load\_all functions because of a class deserialization issue, e.g., Po (no CVSS, pyyaml)
- [CVE-2019-20478](https://cve.now/CVE-2019-20478.md): In ruamel.yaml through 0.16.7, the load method allows remote code execution if the application calls this method with an untrusted argument. (no CVSS)
- [CVE-2011-2054](https://cve.now/CVE-2011-2054.md): Cisco ASA Secondary Authentication Bypass Vulnerability (CVSS 4.3, Cisco ASA)
- [CVE-2015-0749](https://cve.now/CVE-2015-0749.md): Cisco Unified Communications Manager Cross-Site Scripting Vulnerability (CVSS 4.3, Cisco Unified Communications Manager)
- [CVE-2015-9543](https://cve.now/CVE-2015-9543.md): An issue was discovered in OpenStack Nova before 18.2.4, 19.x before 19.1.0, and 20.x before 20.1.0. (no CVSS, nova)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2020-02-19
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.