# CVEs published 2020-02-24

49 CVEs were published on February 24, 2020: 6 critical, 3 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2020-9385](https://cve.now/CVE-2020-9385.md): A NULL Pointer Dereference exists in libzint in Zint 2.7.1 because multiple + characters are mishandled in add\_on in upcean.c, when called f (no CVSS)
- [CVE-2020-9382](https://cve.now/CVE-2020-9382.md): An issue was discovered in the Widgets extension through 1.4.0 for MediaWiki. (no CVSS)
- [CVE-2020-9381](https://cve.now/CVE-2020-9381.md): controllers/admin.js in Total.js CMS 13 allows remote attackers to execute arbitrary code via a POST to the /admin/api/widgets/ URI. (no CVSS)
- [CVE-2020-1938](https://cve.now/CVE-2020-1938.md): When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat. (CVSS 9.8, KEV, Apache Tomcat · org.apache.tomcat.embed:tomcat-embed-core)
- [CVE-2020-1935](https://cve.now/CVE-2020-1935.md): In Apache Tomcat 9.0.0.M1 to 9.0.30, 8.5.0 to 8.5.50 and 7.0.0 to 7.0.99 the HTTP header parsing code used an approach to end-of-line parsin (no CVSS, Apache Tomcat · tomcat +2)
- [CVE-2019-17569](https://cve.now/CVE-2019-17569.md): The refactoring present in Apache Tomcat 9.0.28 to 9.0.30, 8.5.48 to 8.5.50 and 7.0.98 to 7.0.99 introduced a regression. (no CVSS, Apache Tomcat · org.apache.tomcat.embed:tomcat-embed-core +1)
- [CVE-2020-1937](https://cve.now/CVE-2020-1937.md): Kylin has some restful apis which will concatenate SQLs with the user input string, a user is likely to be able to run malicious database qu (no CVSS, Apache Kylin · org.apache.kylin:kylin-server-base)
- [CVE-2020-9374](https://cve.now/CVE-2020-9374.md): On TP-Link TL-WR849N 0.9.1 4.16 devices, a remote command execution vulnerability in the diagnostics area can be exploited when an attacker (no CVSS)
- [CVE-2019-17229](https://cve.now/CVE-2019-17229.md): includes/options.php in the motors-car-dealership-classified-listings (aka Motors - Car Dealer & Classified Ads) plugin through 1.4.0 for Wo (no CVSS)
- [CVE-2019-17228](https://cve.now/CVE-2019-17228.md): includes/options.php in the motors-car-dealership-classified-listings (aka Motors - Car Dealer & Classified Ads) plugin through 1.4.0 for Wo (no CVSS)
- [CVE-2019-12513](https://cve.now/CVE-2019-12513.md): Stored XSS via DHCP Discover Request Hostname (no CVSS)
- [CVE-2019-12512](https://cve.now/CVE-2019-12512.md): Stored XSS via X-Forwarded-For Header During Incorrect Login (no CVSS)
- [CVE-2019-12511](https://cve.now/CVE-2019-12511.md): Root Command Injection via MAC Address in SOAP API (no CVSS)
- [CVE-2019-12510](https://cve.now/CVE-2019-12510.md): Auth Bypass Via X-Forwarded-For Header in SOAP API (no CVSS)
- [CVE-2018-14705](https://cve.now/CVE-2018-14705.md): Lack of Authentication/Authorization on Administrative Web Pages (no CVSS)
- [CVE-2018-13313](https://cve.now/CVE-2018-13313.md): Admin Password returned in password.htm (no CVSS)
- [CVE-2019-10799](https://cve.now/CVE-2019-10799.md): compile-sass prior to 1.0.5 allows execution of arbritary commands. (no CVSS, compile-sass)
- [CVE-2019-10796](https://cve.now/CVE-2019-10796.md): rpi through 0.0.3 allows execution of arbritary commands. (no CVSS, rpi)
- [CVE-2019-10798](https://cve.now/CVE-2019-10798.md): rdf-graph-array through 0.3.0-rc6 manipulation of JavaScript objects resutling in Prototype Pollution. (no CVSS, rdf-graph-array)
- [CVE-2020-5245](https://cve.now/CVE-2020-5245.md): Remote Code Execution (RCE) vulnerability in dropwizard-validation (CVSS 7.9, dropwizard-validation · io.dropwizard:dropwizard-validation)
- [CVE-2020-9369](https://cve.now/CVE-2020-9369.md): Sympa 6.2.38 through 6.2.52 allows remote attackers to cause a denial of service (disk consumption from temporary files, and a flood of noti (no CVSS)
- [CVE-2020-5244](https://cve.now/CVE-2020-5244.md): Private data exposure via REST API in BuddyPress (CVSS 8.0, BuddyPress · buddypress/buddypress)
- [CVE-2016-11020](https://cve.now/CVE-2016-11020.md): Kunena before 5.0.4 does not restrict avatar file extensions to gif, jpeg, jpg, and png. (no CVSS)
- [CVE-2012-0785](https://cve.now/CVE-2012-0785.md): Hash collision attack vulnerability in Jenkins before 1.447, Jenkins LTS before 1.424.2, and Jenkins Enterprise by CloudBees 1.424.x before (no CVSS, Jenkins project Jenkins · org.jenkins-ci.main:jenkins-core)
- [CVE-2020-9366](https://cve.now/CVE-2020-9366.md): A buffer overflow was found in the way GNU Screen before 4.8.0 treated the special escape OSC 49. (no CVSS)
- [CVE-2020-9365](https://cve.now/CVE-2020-9365.md): An issue was discovered in Pure-FTPd 1.0.49. (no CVSS)
- [CVE-2020-4222](https://cve.now/CVE-2020-4222.md): IBM Spectrum Protect Plus 10.1.0 and 10.1.5 could allow a remote attacker to execute arbitrary code on the system. (CVSS 9.8, IBM Spectrum Protect Plus)
- [CVE-2020-4213](https://cve.now/CVE-2020-4213.md): IBM Spectrum Protect Plus 10.1.0 and 10.1.5 could allow a remote attacker to execute arbitrary code on the system. (CVSS 9.8, IBM Spectrum Protect Plus)
- [CVE-2020-4212](https://cve.now/CVE-2020-4212.md): IBM Spectrum Protect Plus 10.1.0 and 10.1.5 could allow a remote attacker to execute arbitrary code on the system. (CVSS 9.8, IBM Spectrum Protect Plus)
- [CVE-2020-4211](https://cve.now/CVE-2020-4211.md): IBM Spectrum Protect Plus 10.1.0 and 10.1.5 could allow a remote attacker to execute arbitrary code on the system. (CVSS 9.8, IBM Spectrum Protect Plus)
- [CVE-2020-4210](https://cve.now/CVE-2020-4210.md): IBM Spectrum Protect Plus 10.1.0 and 10.1.5 could allow a remote attacker to execute arbitrary code on the system. (CVSS 9.8, IBM Spectrum Protect Plus)
- [CVE-2019-4745](https://cve.now/CVE-2019-4745.md): IBM Maximo Asset Management 7.6.1.0 could allow a remote attacker to disclose sensitive information to an authenticated user due to disclosi (CVSS 4.3, IBM Maximo Asset Management)
- [CVE-2019-4703](https://cve.now/CVE-2019-4703.md): IBM Spectrum Protect Plus 10.1.0 and 10.5.0, when protecting Microsoft SQL or Microsoft Exchange, could allow an attacker with intimate know (CVSS 5.3, IBM Spectrum Protect Plus)
- [CVE-2019-4595](https://cve.now/CVE-2019-4595.md): IBM Sterling B2B Integrator Standard Edition 5.2.0.0 through 5.2.6.5 could allow a remote attacker to conduct phishing attacks, using an ope (CVSS 6.8, IBM Sterling B2B Integrator)
- [CVE-2020-9362](https://cve.now/CVE-2020-9362.md): The Quick Heal AV parsing engine (November 2019) allows virus-detection bypass via a crafted GPFLAG in a ZIP archive. (no CVSS)
- [CVE-2020-9363](https://cve.now/CVE-2020-9363.md): The Sophos AV parsing engine before 2020-01-14 allows virus-detection bypass via a crafted ZIP archive. (no CVSS)
- [CVE-2020-8130](https://cve.now/CVE-2020-8130.md): There is an OS command injection vulnerability in Ruby Rake \< 12.3.3 in Rake::FileList when supplying a filename that begins with the pipe c (no CVSS, https://github.com/ruby/ruby · rake)
- [CVE-2020-8131](https://cve.now/CVE-2020-8131.md): Arbitrary filesystem write vulnerability in Yarn before 1.22.0 allows attackers to write to any path on the filesystem and potentially lead (no CVSS, yarn)
- [CVE-2019-18182](https://cve.now/CVE-2019-18182.md): pacman before 5.2 is vulnerable to arbitrary command injection in conf.c in the download\_with\_xfercommand() function. (no CVSS)
- [CVE-2019-18183](https://cve.now/CVE-2019-18183.md): pacman before 5.2 is vulnerable to arbitrary command injection in lib/libalpm/sync.c in the apply\_deltas() function. (no CVSS)
- [CVE-2019-20480](https://cve.now/CVE-2019-20480.md): In MIELE XGW 3000 ZigBee Gateway before 2.4.0, a malicious website visited by an authenticated admin user or a malicious mail is allowed to (CVSS 4.6)
- [CVE-2019-20481](https://cve.now/CVE-2019-20481.md): In MIELE XGW 3000 ZigBee Gateway before 2.4.0, the Password Change Function does not require knowledge of the old password. (CVSS 4.6)
- [CVE-2020-5186](https://cve.now/CVE-2020-5186.md): DNN (formerly DotNetNuke) through 9.4.4 allows XSS (issue 1 of 2). (no CVSS, DotNetNuke.Core)
- [CVE-2020-5187](https://cve.now/CVE-2020-5187.md): DNN (formerly DotNetNuke) through 9.4.4 allows Path Traversal (issue 2 of 2). (no CVSS, DotNetNuke.Core)
- [CVE-2020-5188](https://cve.now/CVE-2020-5188.md): DNN (formerly DotNetNuke) through 9.4.4 has Insecure Permissions. (no CVSS, DotNetNuke.Core)
- [CVE-2015-9542](https://cve.now/CVE-2015-9542.md): add\_password in pam\_radius\_auth.c in pam\_radius 1.4.0 does not correctly check the length of the input password, and is vulnerable to a stac (no CVSS)
- [CVE-2019-20044](https://cve.now/CVE-2019-20044.md): In Zsh before 5.8, attackers able to execute commands can regain privileges dropped by the --no-PRIVILEGED option. (no CVSS)
- [CVE-2019-15299](https://cve.now/CVE-2019-15299.md): An issue was discovered in Centreon Web through 19.04.3. (no CVSS)
- [CVE-2019-3670](https://cve.now/CVE-2019-3670.md): Remote Code Execution vulnerability (CVSS 8.0, McAfee Web Advisor)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2020-02-24
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.