CVEs published February 27, 2020
78 CVEs were published on February 27, 2020: 0 critical, 6 high. 2 are now in CISA KEV.
- Published
- 78
- Critical
- 0
- High
- 6
- Medium
- 5
- Low
- 0
- Unrated
- 67
- Now in CISA KEV
- 2
- Fix available
- 47
Most affected products
- Apple iOS · Apple macOS +2
- 11
- Apple iOS
- 8
- Apple macOS
- 8
- Apple iOS · Apple tvOS +3
- 5
- Google Chrome
- 5
- Apple iOS · Apple macOS +4
- 3
- PHP Group PHP
- 3
- AirWave Management Platform
- 2
- TONNET DVR
- 2
- ZTE E8820V3
- 2
High 6
- CVE-2020-6418Type confusion in V8 in Google Chrome prior to 80.0.3987.122 allowed a remote attacker to potentially exploit heap corruption via a crafted Google Chrome
- CVE-2020-3837A memory corruption issue was addressed with improved memory handling.Apple iOS · Apple macOS +2
- CVE-2020-7062Null Pointer Dereference in PHP Session Upload ProgressPHP Group PHP
- CVE-2020-5402UAA fails to check the state parameter when authenticating with external IDPsCloud Foundry UAA
- CVE-2020-5400Cloud Controller logs environment variables from app manifestsCloud Foundry CAPI
- CVE-2020-3923TONNET DVR – Broken Access ControlTONNET DVR
Medium, low and unrated 72
- CVE-2020-6386Use after free in speech in Google Chrome prior to 80.0.3987.116 allowed a remote attacker to potentially exploit heap corruption via a crafGoogle Chrome
- CVE-2020-6407Out of bounds memory access in streams in Google Chrome prior to 80.0.3987.122 allowed a remote attacker to potentially exploit heap corruptGoogle Chrome
- CVE-2020-6383Type confusion in V8 in Google Chrome prior to 80.0.3987.116 allowed a remote attacker to potentially exploit heap corruption via a crafted Google Chrome
- CVE-2020-6384Use after free in WebAudio in Google Chrome prior to 80.0.3987.116 allowed a remote attacker to potentially exploit heap corruption via a crGoogle Chrome
- CVE-2020-9432openssl_x509_check_host in lua-openssl 0.7.7-1 mishandles X.509 certificate validation because it uses lua_pushboolean for certain non-boole
- CVE-2020-9433openssl_x509_check_email in lua-openssl 0.7.7-1 mishandles X.509 certificate validation because it uses lua_pushboolean for certain non-bool
- CVE-2020-9434openssl_x509_check_ip_asc in lua-openssl 0.7.7-1 mishandles X.509 certificate validation because it uses lua_pushboolean for certain non-boo
- CVE-2020-9428In Wireshark 3.2.0 to 3.2.1, 3.0.0 to 3.0.8, and 2.6.0 to 2.6.14, the EAP dissector could crash.
- CVE-2020-9429In Wireshark 3.2.0 to 3.2.1, the WireGuard dissector could crash.
- CVE-2020-9430In Wireshark 3.2.0 to 3.2.1, 3.0.0 to 3.0.8, and 2.6.0 to 2.6.14, the WiMax DLMAP dissector could crash.
- CVE-2020-9431In Wireshark 3.2.0 to 3.2.1, 3.0.0 to 3.0.8, and 2.6.0 to 2.6.14, the LTE RRC dissector could leak memory.
- CVE-2018-8878Information disclosure in Asuswrt-Merlin firmware for ASUS devices older than 384.4 and ASUS firmware before 3.0.0.4.382.50470 for devices a
- CVE-2018-8877Information disclosure in Asuswrt-Merlin firmware for ASUS devices older than 384.4 and ASUS firmware before 3.0.0.4.382.50470 for devices a
- CVE-2020-3846A buffer overflow was addressed with improved size validation.Apple iOS · Apple macOS +4
- CVE-2020-3853A type confusion issue was addressed with improved memory handling.Apple iOS · Apple macOS +2
- CVE-2020-3854A memory corruption issue was addressed with improved memory handling.Apple macOS
- CVE-2020-3856A memory corruption issue was addressed with improved input validation.Apple iOS · Apple macOS +2
- CVE-2020-3857A memory corruption issue was addressed with improved memory handling.Apple iOS · Apple macOS +2
- CVE-2020-3858A memory corruption issue was addressed with improved memory handling.Apple iOS
- CVE-2020-3860A memory corruption issue was addressed with improved input validation.Apple iOS · Apple watchOS
- CVE-2020-3861The issue was addressed with improved permissions logic.Apple iTunes for Windows
- CVE-2020-3862A denial of service issue was addressed with improved memory handling.Apple iOS · Apple tvOS +3
- CVE-2020-3865Multiple memory corruption issues were addressed with improved memory handling.Apple iOS · Apple tvOS +3
- CVE-2020-3866This was addressed with additional checks by Gatekeeper on files mounted through a network share.Apple macOS
- CVE-2020-3867A logic issue was addressed with improved state management.Apple iOS · Apple tvOS +3
- CVE-2020-3868Multiple memory corruption issues were addressed with improved memory handling.Apple iOS · Apple tvOS +3
- CVE-2020-3869An issue existed in the handling of the local user's self-view.Apple iOS
- CVE-2020-3870An out-of-bounds read was addressed with improved input validation.Apple iOS · Apple macOS +2
- CVE-2020-3871A memory corruption issue was addressed with improved memory handling.Apple macOS
- CVE-2020-3872A memory initialization issue was addressed with improved memory handling.Apple iOS · Apple macOS +2
- CVE-2020-3873This issue was addressed with improved setting propagation.Apple iOS
- CVE-2020-3874An issued existed in the naming of screenshots.Apple iOS
- CVE-2020-3875A validation issue was addressed with improved input sanitization.Apple iOS · Apple macOS +2
- CVE-2020-3877An out-of-bounds read was addressed with improved input validation.Apple macOS · Apple watchOS
- CVE-2020-3878An out-of-bounds read was addressed with improved input validation.Apple iOS · Apple macOS +4
- CVE-2020-3825Multiple memory corruption issues were addressed with improved memory handling.Apple iOS · Apple tvOS +3
- CVE-2020-3826An out-of-bounds read was addressed with improved input validation.Apple iOS · Apple macOS +4
- CVE-2020-3827A memory corruption issue was addressed with improved input validation.Apple macOS
- CVE-2020-3828A lock screen issue allowed access to contacts on a locked device.Apple iOS
- CVE-2020-3829An out-of-bounds read was addressed with improved bounds checking.Apple iOS · Apple macOS +2
- CVE-2020-3830A validation issue existed in the handling of symlinks.Apple macOS
- CVE-2020-3831A race condition was addressed with improved locking.Apple iOS
- CVE-2020-3833An inconsistent user interface issue was addressed with improved state management.Apple Safari
- CVE-2020-3834A memory corruption issue was addressed with improved state management.Apple watchOS
- CVE-2020-3835A validation issue existed in the handling of symlinks.Apple macOS
- CVE-2020-3836An access issue was addressed with improved memory management.Apple iOS · Apple macOS +2
- CVE-2020-3838The issue was addressed with improved permissions logic.Apple iOS · Apple macOS +2
- CVE-2020-3839A validation issue was addressed with improved input sanitization.Apple macOS
- CVE-2020-3840An off by one issue existed in the handling of racoon configuration files.Apple iOS · Apple macOS +1
- CVE-2020-3841The issue was addressed with improved UI handling.Apple iOS · Apple Safari
- CVE-2020-3842A memory corruption issue was addressed with improved memory handling.Apple iOS · Apple macOS +2
- CVE-2020-3843A memory corruption issue was addressed with improved input validation.Apple iOS-1 · Apple watchOS-1
- CVE-2020-3844This issue was addressed with improved checks.Apple iOS
- CVE-2020-3845A memory corruption issue was addressed with improved memory handling.Apple macOS
- CVE-2020-3859An inconsistent user interface issue was addressed with improved state management.Apple iOS
- CVE-2020-7063Files added to tar with Phar::buildFromIterator have all-access permissionsPHP Group PHP
- CVE-2020-7061heap-buffer-overflow in phar_extract_filePHP Group PHP
- CVE-2020-5401Cloud Foundry GoRouter is vulnerable to cache poisoningCloud Foundry Routing
- CVE-2015-2992Apache Struts before 2.3.20 has a cross-site scripting (XSS) vulnerability.Apache Software Foundation Apache Struts · org.apache.strut…
- CVE-2017-16900Incorrect Access Control in Hunesion i-oneNet 3.0.6042.1200 allows the local user to access other user's information which is unauthorized v
- CVE-2020-7043An issue was discovered in openfortivpn 1.11.0 when used with OpenSSL before 1.0.2.
- CVE-2020-7042An issue was discovered in openfortivpn 1.11.0 when used with OpenSSL 1.0.2 or later.
- CVE-2020-7041An issue was discovered in openfortivpn 1.11.0 when used with OpenSSL 1.0.2 or later.
- CVE-2020-6864ZTE E8820V3 router product is impacted by an information leak vulnerability.ZTE E8820V3
- CVE-2020-6863ZTE E8820V3 router product is impacted by a permission and access control vulnerability.ZTE E8820V3
- CVE-2019-5326An administrative application user of or application user with write access to Aruba Airwave VisualRF is able to obtain code execution on thAirWave Management Platform
- CVE-2019-5323There are command injection vulnerabilities present in the AirWave application.AirWave Management Platform
- CVE-2019-4669IBM Business Process Manager 8.5.7.0 through 8.5.7.0 2017.06, 8.6.0.0 through 8.6.0.0 CF2018.03, and IBM Business Automation Workflow 18.0.0IBM Business Automation Workflow · IBM Business Process Man…
- CVE-2017-6371Synchronet BBS 3.16c for Windows allows remote attackers to cause a denial of service (service crash) via a long string in the HTTP Referer
- CVE-2017-6363In the GD Graphics Library (aka LibGD) through 2.2.5, there is a heap-based buffer over-read in tiffWriter in gd_tiff.c.
- CVE-2020-3924TONNET DVR – Firmware InjectionTONNET DVR
- CVE-2015-5686Parts of the Puppet Enterprise Console 3.x were found to be susceptible to clickjacking and CSRF (Cross-Site Request Forgery) attacks.