# CVEs published 2020-02-20

53 CVEs were published on February 20, 2020: 1 critical, 2 high. Days are UTC.

- [CVE-2020-5243](https://cve.now/CVE-2020-5243.md): Denial of Service in uap-core when processing crafted User-Agent strings (CVSS 5.7, ua-parser uap-core · uap-core +1)
- [CVE-2020-5242](https://cve.now/CVE-2020-5242.md): openHAB exec add-ons allow remote arbitrary command execution (CVSS 7.7, openhab-addons)
- [CVE-2019-19694](https://cve.now/CVE-2019-19694.md): The Trend Micro Security 2019 (15.0.0.1163 and below) consumer family of products is vulnerable to a denial of service (DoS) attack in which (no CVSS, Trend Micro Security)
- [CVE-2020-8601](https://cve.now/CVE-2020-8601.md): Trend Micro Vulnerability Protection 2.0 is affected by a vulnerability that could allow an attack to use the product installer to load othe (no CVSS, Trend Micro Vulnerability Protection)
- [CVE-2019-14688](https://cve.now/CVE-2019-14688.md): Trend Micro has repackaged installers for several Trend Micro products that were found to utilize a version of an install package that had a (no CVSS, Trend Micro IM Security (IMS), Trend Micro Control Manager…)
- [CVE-2020-8960](https://cve.now/CVE-2020-8960.md): Western Digital mycloud.com before Web Version 2.2.0-134 allows XSS. (no CVSS)
- [CVE-2020-8990](https://cve.now/CVE-2020-8990.md): Western Digital My Cloud Home before 3.6.0 and ibi before 3.6.0 allow Session Fixation. (no CVSS)
- [CVE-2020-9003](https://cve.now/CVE-2020-9003.md): A stored XSS vulnerability exists in the Modula Image Gallery plugin before 2.2.5 for WordPress. (no CVSS)
- [CVE-2019-16302](https://cve.now/CVE-2019-16302.md): An issue was discovered in Open Network Operating System (ONOS) 1.14. (no CVSS)
- [CVE-2019-16301](https://cve.now/CVE-2019-16301.md): An issue was discovered in Open Network Operating System (ONOS) 1.14. (no CVSS)
- [CVE-2019-16300](https://cve.now/CVE-2019-16300.md): An issue was discovered in Open Network Operating System (ONOS) 1.14. (no CVSS)
- [CVE-2019-16299](https://cve.now/CVE-2019-16299.md): An issue was discovered in Open Network Operating System (ONOS) 1.14. (no CVSS)
- [CVE-2019-16298](https://cve.now/CVE-2019-16298.md): An issue was discovered in Open Network Operating System (ONOS) 1.14. (no CVSS)
- [CVE-2020-9320](https://cve.now/CVE-2020-9320.md): Avira AV Engine before 8.3.54.138 allows virus-detection bypass via a crafted ISO archive. (no CVSS)
- [CVE-2020-9015](https://cve.now/CVE-2020-9015.md): Arista DCS-7050QX-32S-R 4.20.9M, DCS-7050CX3-32S-R 4.20.11M, and DCS-7280SRAM-48C6-R 4.22.0.1F devices (and possibly other products) allow a (no CVSS)
- [CVE-2019-16297](https://cve.now/CVE-2019-16297.md): An issue was discovered in Open Network Operating System (ONOS) 1.14. (no CVSS)
- [CVE-2019-11189](https://cve.now/CVE-2019-11189.md): Authentication Bypass by Spoofing in org.onosproject.acl (access control) and org.onosproject.mobility (host mobility) in ONOS v2.0 and earl (no CVSS)
- [CVE-2020-9318](https://cve.now/CVE-2020-9318.md): Red Gate SQL Monitor 9.0.13 through 9.2.14 allows an administrative user to perform a SQL injection attack by configuring the SNMP alert set (no CVSS)
- [CVE-2020-6968](https://cve.now/CVE-2020-6968.md): Honeywell INNCOM INNControl 3 allows workstation users to escalate application user privileges through the modification of local configurati (no CVSS, Honeywell INNCOM INNControl)
- [CVE-2020-6977](https://cve.now/CVE-2020-6977.md): A restricted desktop environment escape vulnerability exists in the Kiosk Mode functionality of affected devices. (no CVSS, GE Ultrasound Products)
- [CVE-2020-3765](https://cve.now/CVE-2020-3765.md): Adobe After Effects versions 16.1.2 and earlier have an out-of-bounds write vulnerability. (CVSS 9.8, Adobe After Effects)
- [CVE-2020-3764](https://cve.now/CVE-2020-3764.md): Adobe Media Encoder versions 14.0 and earlier have an out-of-bounds write vulnerability. (no CVSS, Adobe Media Encoder)
- [CVE-2012-3351](https://cve.now/CVE-2012-3351.md): Multiple cross-site scripting (XSS) vulnerabilities in LongTail Video JW Player through 5.10.2295 allow remote attackers to inject arbitrary (no CVSS)
- [CVE-2014-4019](https://cve.now/CVE-2014-4019.md): ZTE ZXV10 W300 router with firmware W300V1.0.0a\_ZRD\_LK stores sensitive information under the web root with insufficient access control, whi (no CVSS)
- [CVE-2011-0699](https://cve.now/CVE-2011-0699.md): Integer signedness error in the btrfs\_ioctl\_space\_info function in the Linux kernel 2.6.37 allows local users to cause a denial of service ( (no CVSS, Linux kernel)
- [CVE-2011-4915](https://cve.now/CVE-2011-4915.md): fs/proc/base.c in the Linux kernel through 3.1 allows local users to obtain sensitive keystroke information via access to /proc/interrupts. (no CVSS, Linux kernel)
- [CVE-2019-4752](https://cve.now/CVE-2019-4752.md): IBM Emptoris Spend Analysis and IBM Emptoris Strategic Supply Management Platform 10.1.0.x, 10.1.1.x, and 10.1.3.x is vulnerable to SQL inje (CVSS 7.6, IBM Emptoris Strategic Supply Management · IBM Emptoris Spe…)
- [CVE-2019-4583](https://cve.now/CVE-2019-4583.md): IBM Maximo Asset Management 7.6.0.10 and 7.6.1.1 could allow an authenticated user to obtain sensitive information from a stack trace that c (CVSS 4.3, IBM Maximo Asset Management)
- [CVE-2015-4410](https://cve.now/CVE-2015-4410.md): The Moped::BSON::ObjecId.legal? method in rubygem-moped before commit dd5a7c14b5d2e466f7875d079af71ad19774609b allows remote attackers to ca (no CVSS, moped)
- [CVE-2015-4411](https://cve.now/CVE-2015-4411.md): The Moped::BSON::ObjecId.legal? method in mongodb/bson-ruby before 3.0.4 as used in rubygem-moped allows remote attackers to cause a denial (no CVSS, bson)
- [CVE-2014-4650](https://cve.now/CVE-2014-4650.md): The CGIHTTPServer module in Python 2.7.5 and 3.3.4 does not properly handle URLs in which URL encoding is used for path separators, which al (no CVSS)
- [CVE-2019-19741](https://cve.now/CVE-2019-19741.md): Electronic Arts Origin 10.5.55.33574 is vulnerable to local privilege escalation due to arbitrary directory DACL manipulation, a different i (no CVSS)
- [CVE-2014-7951](https://cve.now/CVE-2014-7951.md): Directory traversal vulnerability in the Android debug bridge (aka adb) in Android 4.0.4 allows physically proximate attackers with a direct (no CVSS)
- [CVE-2020-9273](https://cve.now/CVE-2020-9273.md): In ProFTPD 1.3.7, it is possible to corrupt the memory pool by interrupting the data transfer channel. (no CVSS)
- [CVE-2020-9272](https://cve.now/CVE-2020-9272.md): ProFTPD 1.3.7 has an out-of-bounds (OOB) read vulnerability in mod\_cap via the cap\_text.c cap\_to\_text function. (no CVSS)
- [CVE-2014-4659](https://cve.now/CVE-2014-4659.md): Ansible before 1.5.5 sets 0644 permissions for sources.list, which might allow local users to obtain sensitive credential information in opp (no CVSS, ansible)
- [CVE-2014-4658](https://cve.now/CVE-2014-4658.md): The vault subsystem in Ansible before 1.5.5 does not set the umask before creation or modification of a vault file, which allows local users (no CVSS, ansible)
- [CVE-2014-4657](https://cve.now/CVE-2014-4657.md): The safe\_eval function in Ansible before 1.5.4 does not properly restrict the code subset, which allows remote attackers to execute arbitrar (no CVSS, ansible)
- [CVE-2012-5363](https://cve.now/CVE-2012-5363.md): The IPv6 implementation in FreeBSD and NetBSD (unknown versions, year 2012 and earlier) allows remote attackers to cause a denial of service (no CVSS)
- [CVE-2012-5362](https://cve.now/CVE-2012-5362.md): The IPv6 implementation in Microsoft Windows 7 and earlier allows remote attackers to cause a denial of service via a flood of ICMPv6 Neighb (no CVSS)
- [CVE-2012-5365](https://cve.now/CVE-2012-5365.md): The IPv6 implementation in FreeBSD and NetBSD (unknown versions, year 2012 and earlier) allows remote attackers to cause a denial of service (no CVSS)
- [CVE-2012-5364](https://cve.now/CVE-2012-5364.md): The IPv6 implementation in Microsoft Windows 7 and earlier allows remote attackers to cause a denial of service via a flood of ICMPv6 Router (no CVSS)
- [CVE-2012-5366](https://cve.now/CVE-2012-5366.md): The IPv6 implementation in Apple Mac OS X (unknown versions, year 2012 and earlier) allows remote attackers to cause a denial of service via (no CVSS)
- [CVE-2020-9308](https://cve.now/CVE-2020-9308.md): archive\_read\_support\_format\_rar5.c in libarchive before 3.4.2 attempts to unpack a RAR5 file with an invalid or corrupted header (such as a (no CVSS)
- [CVE-2011-2498](https://cve.now/CVE-2011-2498.md): The Linux kernel from v2.3.36 before v2.6.39 allows local unprivileged users to cause a denial of service (memory consumption) by triggering (no CVSS, Linux kernel)
- [CVE-2012-2629](https://cve.now/CVE-2012-2629.md): Multiple cross-site request forgery (CSRF) and cross-site scripting (XSS) vulnerabilities in Axous 1.1.1 and earlier allow remote attackers (no CVSS)
- [CVE-2014-3484](https://cve.now/CVE-2014-3484.md): Multiple stack-based buffer overflows in the \_\_dn\_expand function in network/dn\_expand.c in musl libc 1.1x before 1.1.2 and 0.9.13 through 1 (no CVSS, musl libc)
- [CVE-2015-2923](https://cve.now/CVE-2015-2923.md): The Neighbor Discovery (ND) protocol implementation in the IPv6 stack in FreeBSD through 10.1 allows remote attackers to reconfigure a hop-l (no CVSS)
- [CVE-2014-4678](https://cve.now/CVE-2014-4678.md): The safe\_eval function in Ansible before 1.6.4 does not properly restrict the code subset, which allows remote attackers to execute arbitrar (no CVSS, Ansible)
- [CVE-2014-4660](https://cve.now/CVE-2014-4660.md): Ansible before 1.5.5 constructs filenames containing user and password fields on the basis of deb lines in sources.list, which might allow l (no CVSS, ansible)
- [CVE-2016-3182](https://cve.now/CVE-2016-3182.md): The color\_esycc\_to\_rgb function in bin/common/color.c in OpenJPEG before 2.1.1 allows attackers to cause a denial of service (memory corrupt (no CVSS)
- [CVE-2019-20479](https://cve.now/CVE-2019-20479.md): A flaw was found in mod\_auth\_openidc before version 2.4.1. (no CVSS)
- [CVE-2020-9283](https://cve.now/CVE-2020-9283.md): golang.org/x/crypto before v0.0.0-20200220183623-bac4c82f6975 for Go allows a panic during signature verification in the golang.org/x/crypto (no CVSS, golang.org/x/crypto)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2020-02-20
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.