CVEs published February 20, 2020
53 CVEs were published on February 20, 2020: 1 critical, 2 high.
- Published
- 53
- Critical
- 1
- High
- 2
- Medium
- 2
- Low
- 0
- Unrated
- 48
- Now in CISA KEV
- 0
- Fix available
- 10
Most affected products
- ansible
- 4
- Linux kernel
- 3
- Adobe After Effects
- 1
- Adobe Media Encoder
- 1
- Ansible
- 1
- bson
- 1
- GE Ultrasound Products
- 1
- golang.org/x/crypto
- 1
- Honeywell INNCOM INNControl
- 1
- IBM Emptoris Strategic Supply Management · IBM Emptoris Spe…
- 1
Critical 1
High 2
- CVE-2020-5242openHAB exec add-ons allow remote arbitrary command executionopenhab-addons
- CVE-2019-4752IBM Emptoris Spend Analysis and IBM Emptoris Strategic Supply Management Platform 10.1.0.x, 10.1.1.x, and 10.1.3.x is vulnerable to SQL injeIBM Emptoris Strategic Supply Management · IBM Emptoris Spe…
Medium, low and unrated 50
- CVE-2020-5243Denial of Service in uap-core when processing crafted User-Agent stringsua-parser uap-core · uap-core +1
- CVE-2019-19694The Trend Micro Security 2019 (15.0.0.1163 and below) consumer family of products is vulnerable to a denial of service (DoS) attack in whichTrend Micro Security
- CVE-2020-8601Trend Micro Vulnerability Protection 2.0 is affected by a vulnerability that could allow an attack to use the product installer to load otheTrend Micro Vulnerability Protection
- CVE-2019-14688Trend Micro has repackaged installers for several Trend Micro products that were found to utilize a version of an install package that had aTrend Micro IM Security (IMS), Trend Micro Control Manager…
- CVE-2020-8960Western Digital mycloud.com before Web Version 2.2.0-134 allows XSS.
- CVE-2020-8990Western Digital My Cloud Home before 3.6.0 and ibi before 3.6.0 allow Session Fixation.
- CVE-2020-9003A stored XSS vulnerability exists in the Modula Image Gallery plugin before 2.2.5 for WordPress.
- CVE-2019-16302An issue was discovered in Open Network Operating System (ONOS) 1.14.
- CVE-2019-16301An issue was discovered in Open Network Operating System (ONOS) 1.14.
- CVE-2019-16300An issue was discovered in Open Network Operating System (ONOS) 1.14.
- CVE-2019-16299An issue was discovered in Open Network Operating System (ONOS) 1.14.
- CVE-2019-16298An issue was discovered in Open Network Operating System (ONOS) 1.14.
- CVE-2020-9320Avira AV Engine before 8.3.54.138 allows virus-detection bypass via a crafted ISO archive.
- CVE-2020-9015Arista DCS-7050QX-32S-R 4.20.9M, DCS-7050CX3-32S-R 4.20.11M, and DCS-7280SRAM-48C6-R 4.22.0.1F devices (and possibly other products) allow a
- CVE-2019-16297An issue was discovered in Open Network Operating System (ONOS) 1.14.
- CVE-2019-11189Authentication Bypass by Spoofing in org.onosproject.acl (access control) and org.onosproject.mobility (host mobility) in ONOS v2.0 and earl
- CVE-2020-9318Red Gate SQL Monitor 9.0.13 through 9.2.14 allows an administrative user to perform a SQL injection attack by configuring the SNMP alert set
- CVE-2020-6968Honeywell INNCOM INNControl 3 allows workstation users to escalate application user privileges through the modification of local configuratiHoneywell INNCOM INNControl
- CVE-2020-6977A restricted desktop environment escape vulnerability exists in the Kiosk Mode functionality of affected devices.GE Ultrasound Products
- CVE-2020-3764Adobe Media Encoder versions 14.0 and earlier have an out-of-bounds write vulnerability.Adobe Media Encoder
- CVE-2012-3351Multiple cross-site scripting (XSS) vulnerabilities in LongTail Video JW Player through 5.10.2295 allow remote attackers to inject arbitrary
- CVE-2014-4019ZTE ZXV10 W300 router with firmware W300V1.0.0a_ZRD_LK stores sensitive information under the web root with insufficient access control, whi
- CVE-2011-0699Integer signedness error in the btrfs_ioctl_space_info function in the Linux kernel 2.6.37 allows local users to cause a denial of service (Linux kernel
- CVE-2011-4915fs/proc/base.c in the Linux kernel through 3.1 allows local users to obtain sensitive keystroke information via access to /proc/interrupts.Linux kernel
- CVE-2019-4583IBM Maximo Asset Management 7.6.0.10 and 7.6.1.1 could allow an authenticated user to obtain sensitive information from a stack trace that cIBM Maximo Asset Management
- CVE-2015-4410The Moped::BSON::ObjecId.legal? method in rubygem-moped before commit dd5a7c14b5d2e466f7875d079af71ad19774609b allows remote attackers to camoped
- CVE-2015-4411The Moped::BSON::ObjecId.legal? method in mongodb/bson-ruby before 3.0.4 as used in rubygem-moped allows remote attackers to cause a denial bson
- CVE-2014-4650The CGIHTTPServer module in Python 2.7.5 and 3.3.4 does not properly handle URLs in which URL encoding is used for path separators, which al
- CVE-2019-19741Electronic Arts Origin 10.5.55.33574 is vulnerable to local privilege escalation due to arbitrary directory DACL manipulation, a different i
- CVE-2014-7951Directory traversal vulnerability in the Android debug bridge (aka adb) in Android 4.0.4 allows physically proximate attackers with a direct
- CVE-2020-9273In ProFTPD 1.3.7, it is possible to corrupt the memory pool by interrupting the data transfer channel.
- CVE-2020-9272ProFTPD 1.3.7 has an out-of-bounds (OOB) read vulnerability in mod_cap via the cap_text.c cap_to_text function.
- CVE-2014-4659Ansible before 1.5.5 sets 0644 permissions for sources.list, which might allow local users to obtain sensitive credential information in oppansible
- CVE-2014-4658The vault subsystem in Ansible before 1.5.5 does not set the umask before creation or modification of a vault file, which allows local usersansible
- CVE-2014-4657The safe_eval function in Ansible before 1.5.4 does not properly restrict the code subset, which allows remote attackers to execute arbitraransible
- CVE-2012-5363The IPv6 implementation in FreeBSD and NetBSD (unknown versions, year 2012 and earlier) allows remote attackers to cause a denial of service
- CVE-2012-5362The IPv6 implementation in Microsoft Windows 7 and earlier allows remote attackers to cause a denial of service via a flood of ICMPv6 Neighb
- CVE-2012-5365The IPv6 implementation in FreeBSD and NetBSD (unknown versions, year 2012 and earlier) allows remote attackers to cause a denial of service
- CVE-2012-5364The IPv6 implementation in Microsoft Windows 7 and earlier allows remote attackers to cause a denial of service via a flood of ICMPv6 Router
- CVE-2012-5366The IPv6 implementation in Apple Mac OS X (unknown versions, year 2012 and earlier) allows remote attackers to cause a denial of service via
- CVE-2020-9308archive_read_support_format_rar5.c in libarchive before 3.4.2 attempts to unpack a RAR5 file with an invalid or corrupted header (such as a
- CVE-2011-2498The Linux kernel from v2.3.36 before v2.6.39 allows local unprivileged users to cause a denial of service (memory consumption) by triggeringLinux kernel
- CVE-2012-2629Multiple cross-site request forgery (CSRF) and cross-site scripting (XSS) vulnerabilities in Axous 1.1.1 and earlier allow remote attackers
- CVE-2014-3484Multiple stack-based buffer overflows in the __dn_expand function in network/dn_expand.c in musl libc 1.1x before 1.1.2 and 0.9.13 through 1musl libc
- CVE-2015-2923The Neighbor Discovery (ND) protocol implementation in the IPv6 stack in FreeBSD through 10.1 allows remote attackers to reconfigure a hop-l
- CVE-2014-4678The safe_eval function in Ansible before 1.6.4 does not properly restrict the code subset, which allows remote attackers to execute arbitrarAnsible
- CVE-2014-4660Ansible before 1.5.5 constructs filenames containing user and password fields on the basis of deb lines in sources.list, which might allow lansible
- CVE-2016-3182The color_esycc_to_rgb function in bin/common/color.c in OpenJPEG before 2.1.1 allows attackers to cause a denial of service (memory corrupt
- CVE-2019-20479A flaw was found in mod_auth_openidc before version 2.4.1.
- CVE-2020-9283golang.org/x/crypto before v0.0.0-20200220183623-bac4c82f6975 for Go allows a panic during signature verification in the golang.org/x/cryptogolang.org/x/crypto