# CVEs published 2020-02-21

26 CVEs were published on February 21, 2020: 0 critical, 1 high. Days are UTC.

- [CVE-2020-9330](https://cve.now/CVE-2020-9330.md): Certain Xerox WorkCentre printers before 073.xxx.000.02300 do not require the user to reenter or validate LDAP bind credentials when changin (no CVSS)
- [CVE-2020-9329](https://cve.now/CVE-2020-9329.md): Gogs through 0.11.91 allows attackers to violate the admin-specified repo-creation policy due to an internal/db/repo.go race condition. (no CVSS)
- [CVE-2020-9327](https://cve.now/CVE-2020-9327.md): In SQLite 3.31.1, isAuxiliaryVtabOperator allows attackers to trigger a NULL pointer dereference and segmentation fault because of generated (no CVSS, sqlite)
- [CVE-2019-18846](https://cve.now/CVE-2019-18846.md): OX App Suite through 7.10.2 allows SSRF. (no CVSS)
- [CVE-2020-7907](https://cve.now/CVE-2020-7907.md): In the JetBrains Scala plugin before 2019.2.1, some artefact dependencies were resolved over unencrypted connections. (no CVSS)
- [CVE-2012-1093](https://cve.now/CVE-2012-1093.md): The init script in the Debian x11-common package before 1:7.6+12 is vulnerable to a symlink attack that can lead to a privilege escalation d (no CVSS, Debian x11-common)
- [CVE-2012-0844](https://cve.now/CVE-2012-0844.md): Information-disclosure vulnerability in Netsurf through 2.8 due to a world-readable cookie jar. (no CVSS, netsurf)
- [CVE-2012-0828](https://cve.now/CVE-2012-0828.md): Heap-based buffer overflow in Xchat-WDK before 1499-4 (2012-01-18) xchat 2.8.6 on Maemo architecture could allow remote attackers to cause a (no CVSS, Xchat-WDK · xchat)
- [CVE-2013-3587](https://cve.now/CVE-2013-3587.md): The HTTPS protocol, as used in unspecified web applications, can encrypt compressed data without properly obfuscating the length of the unen (no CVSS, HTTPS protocol)
- [CVE-2012-6277](https://cve.now/CVE-2012-6277.md): Multiple unspecified vulnerabilities in Autonomy KeyView IDOL before 10.16, as used in Symantec Mail Security for Microsoft Exchange before (no CVSS, Autonomy KeyView IDOL)
- [CVE-2020-6842](https://cve.now/CVE-2020-6842.md): D-Link DCH-M225 1.05b01 and earlier devices allow remote authenticated admins to execute arbitrary OS commands via shell metacharacters in t (no CVSS)
- [CVE-2013-4088](https://cve.now/CVE-2013-4088.md): Kernel/Modules/AgentTicketWatcher.pm in Open Ticket Request System (OTRS) 3.0.x before 3.0.21, 3.1.x before 3.1.17, and 3.2.x before 3.2.8 d (no CVSS)
- [CVE-2012-0063](https://cve.now/CVE-2012-0063.md): Insecure plugin update mechanism in tucan through 0.3.10 could allow remote attackers to perform man-in-the-middle attacks and execute arbit (no CVSS, tucan)
- [CVE-2013-3551](https://cve.now/CVE-2013-3551.md): Kernel/Modules/AgentTicketPhone.pm in Open Ticket Request System (OTRS) 3.0.x before 3.0.20, 3.1.x before 3.1.16, and 3.2.x before 3.2.7, an (no CVSS)
- [CVE-2020-6841](https://cve.now/CVE-2020-6841.md): D-Link DCH-M225 1.05b01 and earlier devices allow remote attackers to execute arbitrary OS commands via shell metacharacters in the spotifyC (no CVSS)
- [CVE-2019-19865](https://cve.now/CVE-2019-19865.md): Atos Unify OpenScape UC Application V9 before version V9 R4.31.0 and V10 before version V10 R0.6.0 allows XSS. (no CVSS)
- [CVE-2019-19866](https://cve.now/CVE-2019-19866.md): Atos Unify OpenScape UC Web Client V9 before version V9 R4.31.0 and V10 before version V10 R0.6.0 allows remote attackers to obtain sensitiv (no CVSS)
- [CVE-2020-5326](https://cve.now/CVE-2020-5326.md): Affected Dell Client platforms contain a BIOS Setup configuration authentication bypass vulnerability in the pre-boot Intel Rapid Storage Re (CVSS 6.1, Dell Client Consumer and Commercial Platforms)
- [CVE-2020-5324](https://cve.now/CVE-2020-5324.md): Dell Client Consumer and Commercial Platforms contain an Arbitrary File Overwrite Vulnerability. (CVSS 7.1, Dell Client Consumer and Commercial Platforms)
- [CVE-2019-19452](https://cve.now/CVE-2019-19452.md): A buffer overflow was found in Patriot Viper RGB through 1.1 when processing IoControlCode 0x80102040. (no CVSS)
- [CVE-2020-5533](https://cve.now/CVE-2020-5533.md): Cross-site scripting vulnerability in Aterm WG2600HS firmware Ver1.3.2 and earlier allows remote attackers to inject arbitrary web script or (no CVSS, NEC Aterm WG2600HS)
- [CVE-2020-5534](https://cve.now/CVE-2020-5534.md): Aterm WG2600HS firmware Ver1.3.2 and earlier allows an authenticated attacker on the same network segment to execute arbitrary OS commands w (no CVSS, NEC Aterm WG2600HS)
- [CVE-2020-5524](https://cve.now/CVE-2020-5524.md): Aterm series (Aterm WF1200C firmware Ver1.2.1 and earlier, Aterm WG1200CR firmware Ver1.2.1 and earlier, Aterm WG2600HS firmware Ver1.3.2 an (no CVSS, NEC Aterm series)
- [CVE-2020-5525](https://cve.now/CVE-2020-5525.md): Aterm series (Aterm WF1200C firmware Ver1.2.1 and earlier, Aterm WG1200CR firmware Ver1.2.1 and earlier, Aterm WG2600HS firmware Ver1.3.2 an (no CVSS, NEC Aterm series)
- [CVE-2014-7914](https://cve.now/CVE-2014-7914.md): btif/src/btif\_dm.c in Android before 5.1 does not properly enforce the temporary nature of a Bluetooth pairing, which allows user-assisted r (no CVSS, Google Android)
- [CVE-2016-4606](https://cve.now/CVE-2016-4606.md): Curl before 7.49.1 in Apple OS X before macOS Sierra prior to 10.12 allows remote or local attackers to execute arbitrary code, gain sensiti (no CVSS, curl)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2020-02-21
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.