# CVEs published 2020-02-28

38 CVEs were published on February 28, 2020: 0 critical, 3 high. Days are UTC.

- [CVE-2020-6804](https://cve.now/CVE-2020-6804.md): XSS in Mozilla WebThings Gateway (CVSS 8.8, Mozilla WebThings Gateway)
- [CVE-2020-6803](https://cve.now/CVE-2020-6803.md): Open redirect in Mozilla WebThings Gateway (CVSS 5.4, Mozilla WebThings Gateway)
- [CVE-2015-3006](https://cve.now/CVE-2015-3006.md): Junos: QFX Series: Insufficient entropy on QFX3500 and QFX3600 platforms when the system boots up (CVSS 6.5)
- [CVE-2015-5361](https://cve.now/CVE-2015-5361.md): Junos: FTPS through SRX opens up wide range of data channel TCP ports (CVSS 6.5)
- [CVE-2019-7007](https://cve.now/CVE-2019-7007.md): Avaya Equinox Conferencing Management (iView) Directory Traversal Vulnerability (CVSS 7.5, Avaya Equinox Conferencing Management)
- [CVE-2019-4301](https://cve.now/CVE-2019-4301.md): BigFix Self-Service Application (SSA) is vulnerable to arbitrary code execution if Javascript code is included in Running Message or Post Me (no CVSS, IBM HCL BigFix Self-Service Application)
- [CVE-2020-9459](https://cve.now/CVE-2020-9459.md): Multiple Stored Cross-site scripting (XSS) vulnerabilities in the Webnus Modern Events Calendar Lite plugin through 5.1.6 for WordPress allo (no CVSS)
- [CVE-2019-10801](https://cve.now/CVE-2019-10801.md): enpeem through 2.2.0 allows execution of arbitrary commands. (no CVSS, enpeem)
- [CVE-2019-10802](https://cve.now/CVE-2019-10802.md): giting version prior to 0.0.8 allows execution of arbritary commands. (no CVSS, giting)
- [CVE-2019-10803](https://cve.now/CVE-2019-10803.md): push-dir through 0.4.1 allows execution of arbritary commands. (no CVSS, push-dir)
- [CVE-2019-10804](https://cve.now/CVE-2019-10804.md): serial-number through 1.3.0 allows execution of arbritary commands. (no CVSS, serial-number)
- [CVE-2019-10805](https://cve.now/CVE-2019-10805.md): valib through 2.0.0 allows Internal Property Tampering. (no CVSS, valib)
- [CVE-2020-9449](https://cve.now/CVE-2020-9449.md): An insecure random number generation vulnerability in BlaB! AX, BlaB! AX Pro, BlaB! WS (client), and BlaB! WS Pro (client) version 19.11 all (no CVSS)
- [CVE-2020-9466](https://cve.now/CVE-2020-9466.md): The Export Users to CSV plugin through 1.4.2 for WordPress allows CSV Injection. (no CVSS)
- [CVE-2019-19943](https://cve.now/CVE-2019-19943.md): The HTTP service in quickweb.exe in Pablo Quick 'n Easy Web Server 3.3.8 allows Remote Unauthenticated Heap Memory Corruption via a large ho (no CVSS)
- [CVE-2020-9465](https://cve.now/CVE-2020-9465.md): An issue was discovered in EyesOfNetwork eonweb 5.1 through 5.3 before 5.3-3. (no CVSS)
- [CVE-2019-15609](https://cve.now/CVE-2019-15609.md): The kill-port-process package version \< 2.2.0 is vulnerable to a Command Injection vulnerability. (no CVSS, kill-port-process)
- [CVE-2020-8127](https://cve.now/CVE-2020-8127.md): Insufficient validation in cross-origin communication (postMessage) in reveal.js version 3.9.1 and earlier allow attackers to perform cross- (no CVSS, reveal.js)
- [CVE-2020-8132](https://cve.now/CVE-2020-8132.md): Lack of input validation in pdf-image npm package version \<= 2.0.0 may allow an attacker to run arbitrary code if PDF file path is construct (no CVSS, pdf-image)
- [CVE-2018-21035](https://cve.now/CVE-2018-21035.md): In Qt through 5.14.1, the WebSocket implementation accepts up to 2GB for frames and 2GB for messages. (CVSS 8.6)
- [CVE-2020-1792](https://cve.now/CVE-2020-1792.md): Honor V10 smartphones with versions earlier than BKL-AL20 10.0.0.156(C00E156R2P4) and versions earlier than BKL-L09 10.0.0.146(C432E4R1P4) h (no CVSS, Honor)
- [CVE-2020-1844](https://cve.now/CVE-2020-1844.md): PCManager with versions earlier than 10.0.5.51 have a privilege escalation vulnerability in Huawei PCManager products. (no CVSS, PCManager)
- [CVE-2020-1877](https://cve.now/CVE-2020-1877.md): NIP6800;Secospace USG6600;USG9500 with versions of V500R001C30; V500R001C60SPC500; V500R005C00SPC100 have an invalid pointer access vulnerab (no CVSS, NIP6800;Secospace USG6600;USG9500)
- [CVE-2020-1876](https://cve.now/CVE-2020-1876.md): NIP6800;Secospace USG6600;USG9500 with versions of V500R001C30; V500R001C60SPC500; V500R005C00SPC100 have an out-of-bounds write vulnerabili (no CVSS, NIP6800;Secospace USG6600;USG9500)
- [CVE-2020-1861](https://cve.now/CVE-2020-1861.md): CloudEngine 12800 with versions of V200R001C00SPC600,V200R001C00SPC700,V200R002C01,V200R002C50SPC800,V200R002C50SPC800PWE,V200R003C00SPC810, (no CVSS, CloudEngine)
- [CVE-2020-1881](https://cve.now/CVE-2020-1881.md): NIP6800;Secospace USG6600;USG9500 products with versions of V500R001C30; V500R001C60SPC500; V500R005C00SPC100 have have a resource managemen (no CVSS, NIP6800;Secospace USG6600;USG9500)
- [CVE-2020-1860](https://cve.now/CVE-2020-1860.md): NIP6800;Secospace USG6600;USG9500 products with versions of V500R001C30; V500R001C60SPC500; V500R005C00SPC100 have an access control bypass (no CVSS, NIP6800;Secospace USG6600;USG9500)
- [CVE-2020-1874](https://cve.now/CVE-2020-1874.md): NIP6800;Secospace USG6600;USG9500 products versions of V500R001C30; V500R001C60SPC500; V500R005C00SPC100 have a invalid pointer access vulne (no CVSS, NIP6800;Secospace USG6600;USG9500)
- [CVE-2020-1873](https://cve.now/CVE-2020-1873.md): NIP6800;Secospace USG6600;USG9500 products with versions of V500R001C30; V500R001C60SPC500; V500R005C00SPC100 have an out-of-bounds read vul (no CVSS, NIP6800;Secospace USG6600;USG9500)
- [CVE-2020-1875](https://cve.now/CVE-2020-1875.md): NIP6800;Secospace USG6600;USG9500 products versions of V500R001C30; V500R001C60SPC500; V500R005C00SPC100 have an invalid pointer access vuln (no CVSS, NIP6800;Secospace USG6600;USG9500)
- [CVE-2020-9463](https://cve.now/CVE-2020-9463.md): Centreon 19.10 allows remote authenticated users to execute arbitrary OS commands via shell metacharacters in the server\_ip field in JSON da (no CVSS)
- [CVE-2020-5247](https://cve.now/CVE-2020-5247.md): HTTP Response Splitting in Puma (CVSS 6.5, Puma)
- [CVE-2020-9447](https://cve.now/CVE-2020-9447.md): There is an XSS (cross-site scripting) vulnerability in GwtUpload 1.0.3 in the file upload functionality. (no CVSS, com.googlecode.gwtupload:gwtupload)
- [CVE-2019-10064](https://cve.now/CVE-2019-10064.md): hostapd before 2.6, in EAP mode, makes calls to the rand() and random() standard library functions without any preceding srand() or srandom( (no CVSS)
- [CVE-2020-9399](https://cve.now/CVE-2020-9399.md): The Avast AV parsing engine allows virus-detection bypass via a crafted ZIP archive. (no CVSS)
- [CVE-2020-9442](https://cve.now/CVE-2020-9442.md): OpenVPN Connect 3.1.0.361 on Windows has Insecure Permissions for %PROGRAMDATA%\\OpenVPN Connect\\drivers\\tap\\amd64\\win10, which allows local (no CVSS)
- [CVE-2019-3698](https://cve.now/CVE-2019-3698.md): nagios cron job allows privilege escalation from user nagios to root (CVSS 5.7, SUSE Linux Enterprise Server · openSUSE Factory)
- [CVE-2019-8741](https://cve.now/CVE-2019-8741.md): A denial of service issue was addressed with improved input validation. (no CVSS, Apple iOS · Apple watchOS +4)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2020-02-28
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.