CVEs published February 28, 2020
38 CVEs were published on February 28, 2020: 0 critical, 3 high.
- Published
- 38
- Critical
- 0
- High
- 3
- Medium
- 5
- Low
- 0
- Unrated
- 30
- Now in CISA KEV
- 0
- Fix available
- 6
Most affected products
- NIP6800;Secospace USG6600;USG9500
- 7
- Mozilla WebThings Gateway
- 2
- Apple iOS · Apple watchOS +4
- 1
- Avaya Equinox Conferencing Management
- 1
- CloudEngine
- 1
- com.googlecode.gwtupload:gwtupload
- 1
- enpeem
- 1
- giting
- 1
- Honor
- 1
- IBM HCL BigFix Self-Service Application
- 1
High 3
- CVE-2020-6804XSS in Mozilla WebThings GatewayMozilla WebThings Gateway
- CVE-2019-7007Avaya Equinox Conferencing Management (iView) Directory Traversal VulnerabilityAvaya Equinox Conferencing Management
- CVE-2018-21035In Qt through 5.14.1, the WebSocket implementation accepts up to 2GB for frames and 2GB for messages.
Medium, low and unrated 35
- CVE-2020-6803Open redirect in Mozilla WebThings GatewayMozilla WebThings Gateway
- CVE-2015-3006Junos: QFX Series: Insufficient entropy on QFX3500 and QFX3600 platforms when the system boots up
- CVE-2015-5361Junos: FTPS through SRX opens up wide range of data channel TCP ports
- CVE-2019-4301BigFix Self-Service Application (SSA) is vulnerable to arbitrary code execution if Javascript code is included in Running Message or Post MeIBM HCL BigFix Self-Service Application
- CVE-2020-9459Multiple Stored Cross-site scripting (XSS) vulnerabilities in the Webnus Modern Events Calendar Lite plugin through 5.1.6 for WordPress allo
- CVE-2019-10801enpeem through 2.2.0 allows execution of arbitrary commands.enpeem
- CVE-2019-10802giting version prior to 0.0.8 allows execution of arbritary commands.giting
- CVE-2019-10803push-dir through 0.4.1 allows execution of arbritary commands.push-dir
- CVE-2019-10804serial-number through 1.3.0 allows execution of arbritary commands.serial-number
- CVE-2019-10805valib through 2.0.0 allows Internal Property Tampering.valib
- CVE-2020-9449An insecure random number generation vulnerability in BlaB! AX, BlaB! AX Pro, BlaB! WS (client), and BlaB! WS Pro (client) version 19.11 all
- CVE-2020-9466The Export Users to CSV plugin through 1.4.2 for WordPress allows CSV Injection.
- CVE-2019-19943The HTTP service in quickweb.exe in Pablo Quick 'n Easy Web Server 3.3.8 allows Remote Unauthenticated Heap Memory Corruption via a large ho
- CVE-2020-9465An issue was discovered in EyesOfNetwork eonweb 5.1 through 5.3 before 5.3-3.
- CVE-2019-15609The kill-port-process package version < 2.2.0 is vulnerable to a Command Injection vulnerability.kill-port-process
- CVE-2020-8127Insufficient validation in cross-origin communication (postMessage) in reveal.js version 3.9.1 and earlier allow attackers to perform cross-reveal.js
- CVE-2020-8132Lack of input validation in pdf-image npm package version <= 2.0.0 may allow an attacker to run arbitrary code if PDF file path is constructpdf-image
- CVE-2020-1792Honor V10 smartphones with versions earlier than BKL-AL20 10.0.0.156(C00E156R2P4) and versions earlier than BKL-L09 10.0.0.146(C432E4R1P4) hHonor
- CVE-2020-1844PCManager with versions earlier than 10.0.5.51 have a privilege escalation vulnerability in Huawei PCManager products.PCManager
- CVE-2020-1877NIP6800;Secospace USG6600;USG9500 with versions of V500R001C30; V500R001C60SPC500; V500R005C00SPC100 have an invalid pointer access vulnerabNIP6800;Secospace USG6600;USG9500
- CVE-2020-1876NIP6800;Secospace USG6600;USG9500 with versions of V500R001C30; V500R001C60SPC500; V500R005C00SPC100 have an out-of-bounds write vulnerabiliNIP6800;Secospace USG6600;USG9500
- CVE-2020-1861CloudEngine 12800 with versions of V200R001C00SPC600,V200R001C00SPC700,V200R002C01,V200R002C50SPC800,V200R002C50SPC800PWE,V200R003C00SPC810,CloudEngine
- CVE-2020-1881NIP6800;Secospace USG6600;USG9500 products with versions of V500R001C30; V500R001C60SPC500; V500R005C00SPC100 have have a resource managemenNIP6800;Secospace USG6600;USG9500
- CVE-2020-1860NIP6800;Secospace USG6600;USG9500 products with versions of V500R001C30; V500R001C60SPC500; V500R005C00SPC100 have an access control bypass NIP6800;Secospace USG6600;USG9500
- CVE-2020-1874NIP6800;Secospace USG6600;USG9500 products versions of V500R001C30; V500R001C60SPC500; V500R005C00SPC100 have a invalid pointer access vulneNIP6800;Secospace USG6600;USG9500
- CVE-2020-1873NIP6800;Secospace USG6600;USG9500 products with versions of V500R001C30; V500R001C60SPC500; V500R005C00SPC100 have an out-of-bounds read vulNIP6800;Secospace USG6600;USG9500
- CVE-2020-1875NIP6800;Secospace USG6600;USG9500 products versions of V500R001C30; V500R001C60SPC500; V500R005C00SPC100 have an invalid pointer access vulnNIP6800;Secospace USG6600;USG9500
- CVE-2020-9463Centreon 19.10 allows remote authenticated users to execute arbitrary OS commands via shell metacharacters in the server_ip field in JSON da
- CVE-2020-5247HTTP Response Splitting in PumaPuma
- CVE-2020-9447There is an XSS (cross-site scripting) vulnerability in GwtUpload 1.0.3 in the file upload functionality.com.googlecode.gwtupload:gwtupload
- CVE-2019-10064hostapd before 2.6, in EAP mode, makes calls to the rand() and random() standard library functions without any preceding srand() or srandom(
- CVE-2020-9399The Avast AV parsing engine allows virus-detection bypass via a crafted ZIP archive.
- CVE-2020-9442OpenVPN Connect 3.1.0.361 on Windows has Insecure Permissions for %PROGRAMDATA%\OpenVPN Connect\drivers\tap\amd64\win10, which allows local
- CVE-2019-3698nagios cron job allows privilege escalation from user nagios to rootSUSE Linux Enterprise Server · openSUSE Factory
- CVE-2019-8741A denial of service issue was addressed with improved input validation.Apple iOS · Apple watchOS +4