CVEs published February 25, 2020
40 CVEs were published on February 25, 2020: 4 critical, 10 high.
- Published
- 40
- Critical
- 4
- High
- 10
- Medium
- 4
- Low
- 1
- Unrated
- 21
- Now in CISA KEV
- 0
- Fix available
- 2
Most affected products
- Moxa
- 12
- IBM Qradar Advisor
- 2
- cardgate/magento2
- 1
- cardgate/woocommerce
- 1
- Druva inSync Mac OS Client
- 1
- Druva inSync Windows Client
- 1
- NaCL
- 1
- RedHat Enterprise Virtualization Hypervisor
- 1
Critical 4
- CVE-2019-5153An exploitable remote code execution vulnerability exists in the iw_webs configuration parsing functionality of the Moxa AWK-3131A firmware Moxa
- CVE-2019-5162An exploitable improper access control vulnerability exists in the iw_webs account settings functionality of the Moxa AWK-3131A firmware verMoxa
- CVE-2019-5138An exploitable command injection vulnerability exists in encrypted diagnostic script functionality of the Moxa AWK-3131A firmware version 1.Moxa
- CVE-2020-9406IBL Online Weather before 4.3.5a allows unauthenticated eval injection via the queryBCP method of the Auxiliary Service.
High 10
- CVE-2020-9394An issue was discovered in the pricing-table-by-supsystic plugin before 1.8.2 for WordPress.
- CVE-2020-9393An issue was discovered in the pricing-table-by-supsystic plugin before 1.8.2 for WordPress.
- CVE-2019-5143An exploitable format string vulnerability exists in the iw_console conio_writestr functionality of the Moxa AWK-3131A firmware version 1.13Moxa
- CVE-2019-5148An exploitable denial-of-service vulnerability exists in ServiceAgent functionality of the Moxa AWK-3131A, firmware version 1.13.Moxa
- CVE-2019-5165An exploitable authentication bypass vulnerability exists in the hostname processing of the Moxa AWK-3131A firmware version 1.13.Moxa
- CVE-2019-5137The usage of hard-coded cryptographic keys within the ServiceAgent binary allows for the decryption of captured traffic across the network fMoxa
- CVE-2019-5136An exploitable privilege escalation vulnerability exists in the iw_console functionality of the Moxa AWK-3131A firmware version 1.13.Moxa
- CVE-2019-5142An exploitable command injection vulnerability exists in the hostname functionality of the Moxa AWK-3131A firmware version 1.13.Moxa
- CVE-2019-5141An exploitable command injection vulnerability exists in the iw_webs functionality of the Moxa AWK-3131A firmware version 1.13.Moxa
- CVE-2019-5140An exploitable command injection vulnerability exists in the iwwebs functionality of the Moxa AWK-3131A firmware version 1.13.Moxa
Medium, low and unrated 26
- CVE-2019-4000Improper neutralization of directives in dynamically evaluated code in Druva inSync Mac OS Client 6.5.0 allows a local, authenticated attackDruva inSync Mac OS Client
- CVE-2020-9398ISPConfig before 3.1.15p3, when the undocumented reverse_proxy_panel_allowed=sites option is manually enabled, allows SQL Injection.
- CVE-2015-5201VDSM and libvirt in Red Hat Enterprise Virtualization Hypervisor (aka RHEV-H) 7-7.x before 7-7.2-20151119.0 and 6-6.x before 6-6.7-20151117.RedHat Enterprise Virtualization Hypervisor
- CVE-2015-0565NaCl in 2015 allowed the CLFLUSH instruction, making rowhammer attacks possible.NaCL
- CVE-2020-8809Gurux GXDLMS Director prior to 8.5.1905.1301 downloads updates to add-ins and OBIS code over an unencrypted HTTP connection.
- CVE-2020-8810An issue was discovered in Gurux GXDLMS Director through 8.5.1905.1301.
- CVE-2020-9379The Software Development Kit of the MiContact Center Business with Site Based Security 8.0 through 9.0.1.0 before KB496276 allows an authent
- CVE-2019-3999Improper neutralization of special elements used in an OS command in Druva inSync Windows Client 6.5.0 allows a local, unauthenticated attacDruva inSync Windows Client
- CVE-2020-9391An issue was discovered in the Linux kernel 5.4 and 5.5 through 5.5.6 on the AArch64 architecture.
- CVE-2020-9008Stored Cross-site scripting (XSS) vulnerability in Blackboard Learn/PeopleTool v9.1 allows users to inject arbitrary web script via the Tile
- CVE-2020-9019The WPJobBoard plugin 5.5.3 for WordPress allows Persistent XSS via the Add Job form, as demonstrated by title and Description.
- CVE-2020-9018LiteCart through 2.2.1 allows admin/?app=users&doc=edit_user CSRF to add a user.
- CVE-2020-9017LiteCart through 2.2.1 allows CSV injection via a customer's profile.
- CVE-2019-12863SolarWinds Orion Platform 2018.4 HF3 (NPM 12.4, NetPath 1.1.4) allows Stored HTML Injection by administrators via the Web Console Settings s
- CVE-2020-9334A stored XSS vulnerability exists in the Envira Photo Gallery plugin through 1.7.6 for WordPress.
- CVE-2020-8794OpenSMTPD before 6.6.4 allows remote code execution because of an out-of-bounds read in mta_io in mta_session.c for multi-line replies.
- CVE-2020-9335Multiple stored XSS vulnerabilities exist in the 10Web Photo Gallery plugin before 1.5.46 WordPress.
- CVE-2020-8793OpenSMTPD before 6.6.4 allows local users to read arbitrary files (e.g., on some Linux distributions) because of a combination of an untrust
- CVE-2019-5139An exploitable use of hard-coded credentials vulnerability exists in multiple iw_* utilities of the Moxa AWK-3131A firmware version 1.13.Moxa
- CVE-2020-9383An issue was discovered in the Linux kernel 3.16 through 5.5.6.
- CVE-2019-4672IBM QRadar Advisor 1.1 through 2.5 could allow an unauthorized attacker to obtain sensitive information from specially crafted HTTP requestsIBM Qradar Advisor
- CVE-2019-4557IBM Qradar Advisor 1.1 through 2.5 with Watson uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt hiIBM Qradar Advisor
- CVE-2020-8818An issue was discovered in the CardGate Payments plugin through 2.0.30 for Magento 2.cardgate/magento2
- CVE-2020-8819An issue was discovered in the CardGate Payments plugin through 3.1.15 for WooCommerce.cardgate/woocommerce
- CVE-2020-9405IBL Online Weather before 4.3.5a allows unauthenticated reflected XSS via the redirect page.
- CVE-2020-9407IBL Online Weather before 4.3.5a allows attackers to obtain sensitive information by reading the IWEBSERVICE_JSONRPC_COOKIE cookie.