Skip to content
OpenAdvisories

Archive

17 February 2020

Vulnerabilities first published on this day (UTC), newest first.

← January 2020 2020 / February /17 March 2020 →
  1. 11
  2. 23
  3. 336
  4. 474
  5. 566
  6. 672
  7. 768
  8. 821
  9. 9 
  10. 1058
  11. 11210
  12. 12117
  13. 13123
  14. 1434
  15. 151
  16. 167
  17. 1763
  18. 1854
  19. 1962
  20. 2053
  21. 2126
  22. 2211
  23. 236
  24. 2450
  25. 2540
  26. 2633
  27. 2778
  28. 2839
  29. 29 
All Critical High Medium Low Exploited only Public exploit

63 results · Feed

  • Unscored —
    CVE-2020-1882

    Huawei mobile phones Ever-L29B versions earlier than 10.0.0.180(C185E6R3P3), earlier than 10.0.0.180(C432E6R1P7), earli…

    Huawei Honor Magic2 HUAWEI Mate 20 X Ever-L29B Network devices
  • Unscored —
    CVE-2020-1830

    Huawei NIP6800 versions V500R001C30, V500R001C60SPC500, and V500R005C00; Secospace USG6600 and USG9500 versions V500R00…

    Huawei NIP6800 Secospace USG6600, USG9500 Network devices
  • Unscored —
    CVE-2020-1811

    GaussDB 200 with version of 6.5.1 have a command injection vulnerability. Due to insufficient input validation, remote …

    Huawei GaussDB 200 Network devices
  • Unscored —
    CVE-2020-1816

    Huawei NIP6800 versions V500R001C30, V500R001C60SPC500, and V500R005C00; Secospace USG6600 and USG9500 versions V500R00…

    Huawei NIP6800 Secospace USG6600, USG9500 Network devices
  • Unscored —
    CVE-2020-1815

    Huawei NIP6800 versions V500R001C30, V500R001C60SPC500, and V500R005C00; Secospace USG6600 and USG9500 versions V500R00…

    Huawei NIP6800 Secospace USG6600, USG9500 Network devices
  • Critical 9.8
    CVE-2014-8089

    Zend Framework SQL injection vulnerability

    SQL injection vulnerability in Zend Framework before 1.12.9, 2.2.x before 2.2.8, and 2.3.x before 2.3.3, when using the sqlsrv PHP extension, allows remote attackers to execute arbitrary SQL commands via a null byte.

    zendframework/zendframework1 zendframework/zendframework zend-framework zendframework/zend-db Ubuntu Packagist
  • Unscored —
    CVE-2015-8751

    Integer overflow in the jas_matrix_create function in JasPer allows context-dependent attackers to have unspecified imp…

  • Unscored —
    CVE-2014-4981

    LPAR2RRD in 3.5 and earlier allows remote attackers to execute arbitrary commands due to insufficient input sanitizatio…

  • Unscored —
    CVE-2014-7236 Public exploit EPSS 56%

    Eval injection vulnerability in lib/TWiki/Plugins.pm in TWiki before 6.0.1 allows remote attackers to execute arbitrary…

  • Unscored —
    CVE-2014-1947 Public exploit

    Stack-based buffer overflow in the WritePSDImage function in coders/psd.c in ImageMagick 6.5.4 and earlier allows remot…

    imagemagick graphicsmagick Debian
  • Unscored —
    CVE-2020-1853

    GaussDB 200 with version of 6.5.1 have a path traversal vulnerability. Due to insufficient input path validation, an au…

    Huawei GaussDB 200 Network devices
  • Unscored —
    CVE-2020-1841

    Huawei CloudLink Board version 20.0.0; DP300 version V500R002C00; RSE6500 versions V100R001C00, V500R002C00, and V500R0…

    Huawei DP300 TE60 RSE6500 Network devices
  • Unscored —
    CVE-2020-1827

    Huawei NIP6800 versions V500R001C30, V500R001C60SPC500, and V500R005C00SPC100; and Secospace USG6600 and USG9500 versio…

    Huawei NIP6800 Secospace USG6600, USG9500 Network devices
  • Unscored —
    CVE-2020-1856

    Huawei NGFW Module, NIP6300, NIP6600, Secospace USG6500, Secospace USG6600, and USG9500 versions V500R001C30, V500R001C…

    Huawei NGFW Module, NIP6300, NIP6600, Secospace USG6500, Secospace USG6600, USG9500 Network devices
  • Unscored —
    CVE-2020-7959

    LabVantage LIMS 8.3 does not properly maintain the confidentiality of database names. For example, the web application …

  • Unscored —
    CVE-2020-1829

    Huawei NIP6800 versions V500R001C30 and V500R001C60SPC500; and Secospace USG6600 and USG9500 versions V500R001C30SPC200…

    Huawei NIP6800 Secospace USG6600 USG9500 Network devices
  • Unscored —
    CVE-2020-8768

    An issue was discovered on Phoenix Contact Emalytics Controller ILC 2050 BI before 1.2.3 and BI-L before 1.2.3 devices.…

  • Unscored —
    CVE-2020-1857

    Huawei NIP6800 versions V500R001C30, V500R001C60SPC500, and V500R005C00SPC100; and Secospace USG6600 and USG9500 versio…

    Huawei NIP6800 Secospace USG6600 USG9500 Network devices
  • Medium 6.1
    CVE-2019-19325

    Reflected XSS in SilverStripe

    SilverStripe through 4.4.x before 4.4.5 and 4.5.x before 4.5.2 allows Reflected XSS on the login form and custom forms. Silverstripe Forms allow malicious HTML or JavaScript to be inserted through non-scalar FormField attributes, which allows performing XSS (…

    silverstripe/framework Packagist
  • Unscored —
    CVE-2020-1828

    Huawei NIP6800 versions V500R001C30, V500R001C60SPC500, and V500R005C00; and Secospace USG6600 and USG9500 versions V50…

    Huawei NIP6800 Secospace USG6600 USG9500 Network devices
  • High 8.6
    CVE-2020-1693

    A flaw was found in Spacewalk up to version 2.9 where it was vulnerable to XML internal entity attacks via the /rpc/api…

    Red Hat spacewalk
  • Unscored —
    CVE-2020-1858

    Huawei products NIP6800 versions V500R001C30, V500R001C60SPC500, and V500R005C00SPC100; Secospace USG6600 versions V500…

    Huawei NIP6800 Secospace USG6600 USG9500 Network devices
  • High 8.8
    CVE-2020-7597

    codecov NPM module allows remote attackers to execute arbitrary commands

    codecov-node npm module before 3.6.5 allows remote attackers to execute arbitrary commands.The value provided as part of the gcov-root argument is executed by the exec function within lib/codecov.js. This vulnerability exists due to an incomplete fix of CVE-2…

    codecov npm
  • High 7.1
    CVE-2019-18998

    Asset Suite Direct Object Reference Access

    Insufficient access control in the web interface of ABB Asset Suite versions 9.0 to 9.3, 9.4 prior to 9.4.2.6, 9.5 prior to 9.5.3.2 and 9.6.0 enables full access to directly referenced objects. An attacker with knowledge of a resource's URL can access the res…

    ABB Asset Suite ICS / OT
  • Medium 4.3
    CVE-2019-20474

    An issue was discovered in Zoho ManageEngine Remote Access Plus 10.0.447. The service to test the mail-server configura…

  • Unscored —
    CVE-2013-7324

    Webkit-GTK 2.x (any version with HTML5 audio/video support based on GStreamer) allows remote attackers to trigger unexp…

  • Unscored —
    CVE-2015-5216

    The Identity Provider (IdP) server in Ipsilon 0.1.0 before 1.0.1 does not properly escape certain characters in a Pytho…

  • Unscored —
    CVE-2015-4715

    The fetch function in OAuth/Curl.php in Dropbox-PHP, as used in ownCloud Server before 6.0.8, 7.x before 7.0.6, and 8.x…

  • Unscored —
    CVE-2015-6922 Public exploit EPSS 82%

    Kaseya Virtual System Administrator (VSA) 7.x before 7.0.0.33, 8.x before 8.0.0.23, 9.0 before 9.0.0.19, and 9.1 before…

  • Unscored —
    CVE-2015-0258

    Multiple incomplete blacklist vulnerabilities in the avatar upload functionality in manageuser.php in Collabtive before…

    collabtive Ubuntu
  • Unscored —
    CVE-2020-9043 Scanner template

    The wpCentral plugin before 1.5.1 for WordPress allows disclosure of the connection key.

  • Unscored —
    CVE-2019-12954

    SolarWinds Network Performance Monitor (Orion Platform 2018, NPM 12.3, NetPath 1.1.3) allows XSS by authenticated users…

  • High 7.0
    CVE-2020-1704

    An insecure modification vulnerability in the /etc/passwd file was found in all versions of OpenShift ServiceMesh (mais…

    Red Hat openshift-service-mesh/kiali-rhel7-operator
  • Unscored —
    CVE-2013-3722

    A Denial of Service (infinite loop) exists in OpenSIPS before 1.10 in lookup.c.

  • Unscored —
    CVE-2013-3738

    A File Inclusion vulnerability exists in Zabbix 2.0.6 due to inadequate sanitization of request strings in CGI scripts,…

    zabbix Debian
  • Medium 5.4
    CVE-2020-9038 Public exploit

    Cross-site Scripting in Joplin

    Joplin through 1.0.184 allows Arbitrary File Read via XSS.

    joplin npm
  • High 8.1
    CVE-2020-1692

    Cross-Site Request Forgery in Moodle

    Moodle before version 3.7.2 is vulnerable to information exposure of service tokens for users enrolled in the same course.

    The Moodle Project moodle moodle/moodle moodle Web / CMS Ubuntu Packagist
  • Unscored —
    CVE-2020-6850

    Utilities.php in the miniorange-saml-20-single-sign-on plugin before 4.8.84 for WordPress allows XSS via a crafted SAML…

  • Unscored —
    CVE-2020-8427

    In Unitrends Backup before 10.4.1, an HTTP request parameter was not properly sanitized, allowing for SQL injection tha…

  • Unscored —
    CVE-2020-8518 Public exploit EPSS 72%

    Horde Groupware Webmail Edition 5.2.22 allows injection of arbitrary PHP code via CSV data, leading to remote code exec…

    php-horde-data php-horde-data Debian Ubuntu