# CVEs published 2020-02-25

40 CVEs were published on February 25, 2020: 4 critical, 10 high. Days are UTC.

- [CVE-2019-4000](https://cve.now/CVE-2019-4000.md): Improper neutralization of directives in dynamically evaluated code in Druva inSync Mac OS Client 6.5.0 allows a local, authenticated attack (no CVSS, Druva inSync Mac OS Client)
- [CVE-2020-9398](https://cve.now/CVE-2020-9398.md): ISPConfig before 3.1.15p3, when the undocumented reverse\_proxy\_panel\_allowed=sites option is manually enabled, allows SQL Injection. (no CVSS)
- [CVE-2015-5201](https://cve.now/CVE-2015-5201.md): VDSM and libvirt in Red Hat Enterprise Virtualization Hypervisor (aka RHEV-H) 7-7.x before 7-7.2-20151119.0 and 6-6.x before 6-6.7-20151117. (no CVSS, RedHat Enterprise Virtualization Hypervisor)
- [CVE-2015-0565](https://cve.now/CVE-2015-0565.md): NaCl in 2015 allowed the CLFLUSH instruction, making rowhammer attacks possible. (no CVSS, NaCL)
- [CVE-2020-8809](https://cve.now/CVE-2020-8809.md): Gurux GXDLMS Director prior to 8.5.1905.1301 downloads updates to add-ins and OBIS code over an unencrypted HTTP connection. (no CVSS)
- [CVE-2020-8810](https://cve.now/CVE-2020-8810.md): An issue was discovered in Gurux GXDLMS Director through 8.5.1905.1301. (no CVSS)
- [CVE-2020-9379](https://cve.now/CVE-2020-9379.md): The Software Development Kit of the MiContact Center Business with Site Based Security 8.0 through 9.0.1.0 before KB496276 allows an authent (no CVSS)
- [CVE-2019-3999](https://cve.now/CVE-2019-3999.md): Improper neutralization of special elements used in an OS command in Druva inSync Windows Client 6.5.0 allows a local, unauthenticated attac (no CVSS, Druva inSync Windows Client)
- [CVE-2020-9394](https://cve.now/CVE-2020-9394.md): An issue was discovered in the pricing-table-by-supsystic plugin before 1.8.2 for WordPress. (CVSS 8.8)
- [CVE-2020-9393](https://cve.now/CVE-2020-9393.md): An issue was discovered in the pricing-table-by-supsystic plugin before 1.8.2 for WordPress. (CVSS 7.2)
- [CVE-2020-9391](https://cve.now/CVE-2020-9391.md): An issue was discovered in the Linux kernel 5.4 and 5.5 through 5.5.6 on the AArch64 architecture. (no CVSS)
- [CVE-2020-9008](https://cve.now/CVE-2020-9008.md): Stored Cross-site scripting (XSS) vulnerability in Blackboard Learn/PeopleTool v9.1 allows users to inject arbitrary web script via the Tile (no CVSS)
- [CVE-2020-9019](https://cve.now/CVE-2020-9019.md): The WPJobBoard plugin 5.5.3 for WordPress allows Persistent XSS via the Add Job form, as demonstrated by title and Description. (no CVSS)
- [CVE-2020-9018](https://cve.now/CVE-2020-9018.md): LiteCart through 2.2.1 allows admin/?app=users&doc=edit\_user CSRF to add a user. (no CVSS)
- [CVE-2020-9017](https://cve.now/CVE-2020-9017.md): LiteCart through 2.2.1 allows CSV injection via a customer's profile. (no CVSS)
- [CVE-2019-12863](https://cve.now/CVE-2019-12863.md): SolarWinds Orion Platform 2018.4 HF3 (NPM 12.4, NetPath 1.1.4) allows Stored HTML Injection by administrators via the Web Console Settings s (no CVSS)
- [CVE-2020-9334](https://cve.now/CVE-2020-9334.md): A stored XSS vulnerability exists in the Envira Photo Gallery plugin through 1.7.6 for WordPress. (no CVSS)
- [CVE-2020-8794](https://cve.now/CVE-2020-8794.md): OpenSMTPD before 6.6.4 allows remote code execution because of an out-of-bounds read in mta\_io in mta\_session.c for multi-line replies. (no CVSS)
- [CVE-2020-9335](https://cve.now/CVE-2020-9335.md): Multiple stored XSS vulnerabilities exist in the 10Web Photo Gallery plugin before 1.5.46 WordPress. (no CVSS)
- [CVE-2020-8793](https://cve.now/CVE-2020-8793.md): OpenSMTPD before 6.6.4 allows local users to read arbitrary files (e.g., on some Linux distributions) because of a combination of an untrust (no CVSS)
- [CVE-2019-5139](https://cve.now/CVE-2019-5139.md): An exploitable use of hard-coded credentials vulnerability exists in multiple iw\_\* utilities of the Moxa AWK-3131A firmware version 1.13. (CVSS 6.2, Moxa)
- [CVE-2019-5143](https://cve.now/CVE-2019-5143.md): An exploitable format string vulnerability exists in the iw\_console conio\_writestr functionality of the Moxa AWK-3131A firmware version 1.13 (CVSS 8.8, Moxa)
- [CVE-2019-5148](https://cve.now/CVE-2019-5148.md): An exploitable denial-of-service vulnerability exists in ServiceAgent functionality of the Moxa AWK-3131A, firmware version 1.13. (CVSS 7.5, Moxa)
- [CVE-2019-5165](https://cve.now/CVE-2019-5165.md): An exploitable authentication bypass vulnerability exists in the hostname processing of the Moxa AWK-3131A firmware version 1.13. (CVSS 8.0, Moxa)
- [CVE-2020-9383](https://cve.now/CVE-2020-9383.md): An issue was discovered in the Linux kernel 3.16 through 5.5.6. (no CVSS)
- [CVE-2019-5153](https://cve.now/CVE-2019-5153.md): An exploitable remote code execution vulnerability exists in the iw\_webs configuration parsing functionality of the Moxa AWK-3131A firmware (CVSS 9.9, Moxa)
- [CVE-2019-5162](https://cve.now/CVE-2019-5162.md): An exploitable improper access control vulnerability exists in the iw\_webs account settings functionality of the Moxa AWK-3131A firmware ver (CVSS 9.9, Moxa)
- [CVE-2019-5137](https://cve.now/CVE-2019-5137.md): The usage of hard-coded cryptographic keys within the ServiceAgent binary allows for the decryption of captured traffic across the network f (CVSS 7.5, Moxa)
- [CVE-2019-5138](https://cve.now/CVE-2019-5138.md): An exploitable command injection vulnerability exists in encrypted diagnostic script functionality of the Moxa AWK-3131A firmware version 1. (CVSS 9.9, Moxa)
- [CVE-2019-5136](https://cve.now/CVE-2019-5136.md): An exploitable privilege escalation vulnerability exists in the iw\_console functionality of the Moxa AWK-3131A firmware version 1.13. (CVSS 8.8, Moxa)
- [CVE-2019-5142](https://cve.now/CVE-2019-5142.md): An exploitable command injection vulnerability exists in the hostname functionality of the Moxa AWK-3131A firmware version 1.13. (CVSS 7.2, Moxa)
- [CVE-2019-5141](https://cve.now/CVE-2019-5141.md): An exploitable command injection vulnerability exists in the iw\_webs functionality of the Moxa AWK-3131A firmware version 1.13. (CVSS 8.8, Moxa)
- [CVE-2019-5140](https://cve.now/CVE-2019-5140.md): An exploitable command injection vulnerability exists in the iwwebs functionality of the Moxa AWK-3131A firmware version 1.13. (CVSS 8.8, Moxa)
- [CVE-2019-4672](https://cve.now/CVE-2019-4672.md): IBM QRadar Advisor 1.1 through 2.5 could allow an unauthorized attacker to obtain sensitive information from specially crafted HTTP requests (CVSS 5.3, IBM Qradar Advisor)
- [CVE-2019-4557](https://cve.now/CVE-2019-4557.md): IBM Qradar Advisor 1.1 through 2.5 with Watson uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt hi (CVSS 5.9, IBM Qradar Advisor)
- [CVE-2020-8818](https://cve.now/CVE-2020-8818.md): An issue was discovered in the CardGate Payments plugin through 2.0.30 for Magento 2. (no CVSS, cardgate/magento2)
- [CVE-2020-8819](https://cve.now/CVE-2020-8819.md): An issue was discovered in the CardGate Payments plugin through 3.1.15 for WooCommerce. (no CVSS, cardgate/woocommerce)
- [CVE-2020-9405](https://cve.now/CVE-2020-9405.md): IBL Online Weather before 4.3.5a allows unauthenticated reflected XSS via the redirect page. (CVSS 5.8)
- [CVE-2020-9406](https://cve.now/CVE-2020-9406.md): IBL Online Weather before 4.3.5a allows unauthenticated eval injection via the queryBCP method of the Auxiliary Service. (CVSS 9.0)
- [CVE-2020-9407](https://cve.now/CVE-2020-9407.md): IBL Online Weather before 4.3.5a allows attackers to obtain sensitive information by reading the IWEBSERVICE\_JSONRPC\_COOKIE cookie. (CVSS 3.1)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2020-02-25
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.