CVEs published February 24, 2020
49 CVEs were published on February 24, 2020: 6 critical, 3 high. 1 is now in CISA KEV.
- Published
- 49
- Critical
- 6
- High
- 3
- Medium
- 5
- Low
- 0
- Unrated
- 35
- Now in CISA KEV
- 1
- Fix available
- 12
Most affected products
- IBM Spectrum Protect Plus
- 6
- DotNetNuke.Core
- 3
- Apache Kylin · org.apache.kylin:kylin-server-base
- 1
- Apache Tomcat · org.apache.tomcat.embed:tomcat-embed-core
- 1
- Apache Tomcat · org.apache.tomcat.embed:tomcat-embed-core +1
- 1
- Apache Tomcat · tomcat +2
- 1
- BuddyPress · buddypress/buddypress
- 1
- compile-sass
- 1
- dropwizard-validation · io.dropwizard:dropwizard-validation
- 1
- https://github.com/ruby/ruby · rake
- 1
Critical 6
- CVE-2020-1938When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat.Apache Tomcat · org.apache.tomcat.embed:tomcat-embed-core
- CVE-2020-4222IBM Spectrum Protect Plus 10.1.0 and 10.1.5 could allow a remote attacker to execute arbitrary code on the system.IBM Spectrum Protect Plus
- CVE-2020-4213IBM Spectrum Protect Plus 10.1.0 and 10.1.5 could allow a remote attacker to execute arbitrary code on the system.IBM Spectrum Protect Plus
- CVE-2020-4212IBM Spectrum Protect Plus 10.1.0 and 10.1.5 could allow a remote attacker to execute arbitrary code on the system.IBM Spectrum Protect Plus
- CVE-2020-4211IBM Spectrum Protect Plus 10.1.0 and 10.1.5 could allow a remote attacker to execute arbitrary code on the system.IBM Spectrum Protect Plus
- CVE-2020-4210IBM Spectrum Protect Plus 10.1.0 and 10.1.5 could allow a remote attacker to execute arbitrary code on the system.IBM Spectrum Protect Plus
High 3
Medium, low and unrated 40
- CVE-2020-9385A NULL Pointer Dereference exists in libzint in Zint 2.7.1 because multiple + characters are mishandled in add_on in upcean.c, when called f
- CVE-2020-9382An issue was discovered in the Widgets extension through 1.4.0 for MediaWiki.
- CVE-2020-9381controllers/admin.js in Total.js CMS 13 allows remote attackers to execute arbitrary code via a POST to the /admin/api/widgets/ URI.
- CVE-2020-1935In Apache Tomcat 9.0.0.M1 to 9.0.30, 8.5.0 to 8.5.50 and 7.0.0 to 7.0.99 the HTTP header parsing code used an approach to end-of-line parsinApache Tomcat · tomcat +2
- CVE-2019-17569The refactoring present in Apache Tomcat 9.0.28 to 9.0.30, 8.5.48 to 8.5.50 and 7.0.98 to 7.0.99 introduced a regression.Apache Tomcat · org.apache.tomcat.embed:tomcat-embed-core +1
- CVE-2020-1937Kylin has some restful apis which will concatenate SQLs with the user input string, a user is likely to be able to run malicious database quApache Kylin · org.apache.kylin:kylin-server-base
- CVE-2020-9374On TP-Link TL-WR849N 0.9.1 4.16 devices, a remote command execution vulnerability in the diagnostics area can be exploited when an attacker
- CVE-2019-17229includes/options.php in the motors-car-dealership-classified-listings (aka Motors - Car Dealer & Classified Ads) plugin through 1.4.0 for Wo
- CVE-2019-17228includes/options.php in the motors-car-dealership-classified-listings (aka Motors - Car Dealer & Classified Ads) plugin through 1.4.0 for Wo
- CVE-2019-12513Stored XSS via DHCP Discover Request Hostname
- CVE-2019-12512Stored XSS via X-Forwarded-For Header During Incorrect Login
- CVE-2019-12511Root Command Injection via MAC Address in SOAP API
- CVE-2019-12510Auth Bypass Via X-Forwarded-For Header in SOAP API
- CVE-2018-14705Lack of Authentication/Authorization on Administrative Web Pages
- CVE-2018-13313Admin Password returned in password.htm
- CVE-2019-10799compile-sass prior to 1.0.5 allows execution of arbritary commands.compile-sass
- CVE-2019-10796rpi through 0.0.3 allows execution of arbritary commands.rpi
- CVE-2019-10798rdf-graph-array through 0.3.0-rc6 manipulation of JavaScript objects resutling in Prototype Pollution.rdf-graph-array
- CVE-2020-9369Sympa 6.2.38 through 6.2.52 allows remote attackers to cause a denial of service (disk consumption from temporary files, and a flood of noti
- CVE-2016-11020Kunena before 5.0.4 does not restrict avatar file extensions to gif, jpeg, jpg, and png.
- CVE-2012-0785Hash collision attack vulnerability in Jenkins before 1.447, Jenkins LTS before 1.424.2, and Jenkins Enterprise by CloudBees 1.424.x before Jenkins project Jenkins · org.jenkins-ci.main:jenkins-core
- CVE-2020-9366A buffer overflow was found in the way GNU Screen before 4.8.0 treated the special escape OSC 49.
- CVE-2020-9365An issue was discovered in Pure-FTPd 1.0.49.
- CVE-2019-4745IBM Maximo Asset Management 7.6.1.0 could allow a remote attacker to disclose sensitive information to an authenticated user due to disclosiIBM Maximo Asset Management
- CVE-2019-4703IBM Spectrum Protect Plus 10.1.0 and 10.5.0, when protecting Microsoft SQL or Microsoft Exchange, could allow an attacker with intimate knowIBM Spectrum Protect Plus
- CVE-2019-4595IBM Sterling B2B Integrator Standard Edition 5.2.0.0 through 5.2.6.5 could allow a remote attacker to conduct phishing attacks, using an opeIBM Sterling B2B Integrator
- CVE-2020-9362The Quick Heal AV parsing engine (November 2019) allows virus-detection bypass via a crafted GPFLAG in a ZIP archive.
- CVE-2020-9363The Sophos AV parsing engine before 2020-01-14 allows virus-detection bypass via a crafted ZIP archive.
- CVE-2020-8130There is an OS command injection vulnerability in Ruby Rake < 12.3.3 in Rake::FileList when supplying a filename that begins with the pipe chttps://github.com/ruby/ruby · rake
- CVE-2020-8131Arbitrary filesystem write vulnerability in Yarn before 1.22.0 allows attackers to write to any path on the filesystem and potentially lead yarn
- CVE-2019-18182pacman before 5.2 is vulnerable to arbitrary command injection in conf.c in the download_with_xfercommand() function.
- CVE-2019-18183pacman before 5.2 is vulnerable to arbitrary command injection in lib/libalpm/sync.c in the apply_deltas() function.
- CVE-2019-20480In MIELE XGW 3000 ZigBee Gateway before 2.4.0, a malicious website visited by an authenticated admin user or a malicious mail is allowed to
- CVE-2019-20481In MIELE XGW 3000 ZigBee Gateway before 2.4.0, the Password Change Function does not require knowledge of the old password.
- CVE-2020-5186DNN (formerly DotNetNuke) through 9.4.4 allows XSS (issue 1 of 2).DotNetNuke.Core
- CVE-2020-5187DNN (formerly DotNetNuke) through 9.4.4 allows Path Traversal (issue 2 of 2).DotNetNuke.Core
- CVE-2020-5188DNN (formerly DotNetNuke) through 9.4.4 has Insecure Permissions.DotNetNuke.Core
- CVE-2015-9542add_password in pam_radius_auth.c in pam_radius 1.4.0 does not correctly check the length of the input password, and is vulnerable to a stac
- CVE-2019-20044In Zsh before 5.8, attackers able to execute commands can regain privileges dropped by the --no-PRIVILEGED option.
- CVE-2019-15299An issue was discovered in Centreon Web through 19.04.3.