Skip to content
Noroxi

By publication date

Exploited and new serious CVEs: January 2020

119 records · 7 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

Page 2 of 2

  • CVE-2013-1602
    35Monitor

    An Information Disclosure vulnerability exists due to insufficient validation of authentication cookies for the RTSP session in D-Link DCS-5

    HighCVSS 7.5Proof of conceptEPSS 15%

    dlink · dcs-3411 firmwareJan 28, 2020

  • CVE-2013-1603
    26Monitor

    An Authentication vulnerability exists in D-LINK WCS-1100 1.02, TESCO DCS-2121 1.05_TESCO, TESCO DCS-2102 1.05_TESCO, DCS-7510 1.00, DCS-741

    MediumCVSS 5.3Proof of conceptEPSS 16%

    dlink · dcs-3411 firmwareJan 28, 2020

  • CVE-2019-20215
    62This week

    D-Link DIR-859 1.05 and 1.06B01 Beta01 devices allow remote attackers to execute arbitrary OS commands via a urn: to the M-SEARCH method in

    CriticalCVSS 9.8WeaponizedEPSS 75%

    dlink · dir-859 firmwareJan 28, 2020

  • CVE-2020-7247
    99Now

    smtp_mailaddr in smtp_session.c in OpenSMTPD 6.6, as used in OpenBSD 6.6 and other products, allows remote attackers to execute arbitrary co

    CriticalCVSS 9.8KEVWeaponizedEPSS 98%

    openbsd · opensmtpdJan 29, 2020

  • CVE-2013-2567
    34Monitor

    An Authentication Bypass vulnerability exists in the web interface in Zavio IP Cameras through 1.6.03 due to a hardcoded admin account found

    HighCVSS 7.5Proof of conceptEPSS 14%

    zavio · f3105 firmwareJan 29, 2020

  • CVE-2020-8416
    34Monitor

    IKTeam BearFTP before 0.2.0 allows remote attackers to achieve denial of service via a large volume of connections to the PASV mode port.

    HighCVSS 7.5Proof of conceptEPSS 14%

    iktm · bearftpJan 29, 2020

  • CVE-2013-2568
    54Plan

    A Command Injection vulnerability exists in Zavio IP Cameras through 1.6.3 via the ap parameter to /cgi-bin/mft/wireless_mft.cgi, which coul

    CriticalCVSS 9.8Proof of conceptEPSS 48%

    zavio · f3105 firmwareJan 29, 2020

  • CVE-2013-2569
    39Monitor

    A Security Bypass vulnerability exists in Zavio IP Cameras through 1.6.3 because the RTSP protocol authentication is disabled by default, wh

    HighCVSS 7.5Proof of conceptEPSS 30%

    zavio · f3105 firmwareJan 29, 2020

  • CVE-2013-2570
    47Plan

    A Command Injection vulnerability exists in Zavio IP Cameras through 1.6.3 in the General.Time.NTP.Server parameter to the sub_C8C8 function

    CriticalCVSS 9.8Proof of conceptEPSS 26%

    zavio · f3105 firmwareJan 29, 2020

  • CVE-2013-3215
    60This week

    vtiger CRM 5.4.0 and earlier contain an Authentication Bypass Vulnerability due to improper authentication validation in the validateSession

    CriticalCVSS 9.8WeaponizedEPSS 68%

    vtiger · vtiger crmJan 29, 2020

  • CVE-2019-18634
    37Monitor

    In Sudo before 1.8.26, if pwfeedback is enabled in /etc/sudoers, users can trigger a stack-based buffer overflow in the privileged sudo proc

    HighCVSS 7.8Proof of conceptEPSS 19%

    sudo project · sudoJan 29, 2020

  • CVE-2013-2572
    35Monitor

    A Security Bypass vulnerability exists in TP-LINK IP Cameras TL-SC 3130, TL-SC 3130G, 3171G, 4171G, and 3130 1.6.18P12 due to default hard-c

    HighCVSS 7.5Proof of conceptEPSS 16%

    tp-link · tl-sc 3130 firmwareJan 29, 2020

  • CVE-2013-2573
    52Plan

    A Command Injection vulnerability exists in the ap parameter to the /cgi-bin/mft/wireless_mft.cgi file in TP-Link IP Cameras TL-SC 3130, TL-

    CriticalCVSS 9.8Proof of conceptEPSS 42%

    tp-link · tl-sc 3130g firmwareJan 29, 2020

  • CVE-2013-2574
    39Monitor

    An Access vulnerability exists in FOSCAM IP Camera FI8620 due to insufficient access restrictions in the /tmpfs/ and /log/ directories, whic

    HighCVSS 7.5Proof of conceptEPSS 29%

    foscam · fi8620 firmwareJan 29, 2020

  • CVE-2020-3716
    43Plan

    Magento versions 2.3.3 and earlier, 2.2.10 and earlier, 1.14.4.3 and earlier, and 1.9.4.3 and earlier have a deserialization of untrusted da

    CriticalCVSS 9.8No exploitEPSS 13%

    magento · magentoJan 29, 2020

  • CVE-2019-20445
    40Plan

    HttpObjectDecoder.java in Netty before 4.1.44 allows a Content-Length header to be accompanied by a second Content-Length header, or by a Tr

    CriticalCVSS 9.1No exploitEPSS 13%

    netty · nettyJan 29, 2020

  • CVE-2013-0291
    35Monitor

    NextGEN Gallery Plugin for WordPress 1.9.10 and 1.9.11 has a Path Disclosure Vulnerability

    HighCVSS 7.5Proof of conceptEPSS 15%

    imagely · nextgen galleryJan 30, 2020

  • CVE-2014-8322
    46Plan

    Stack-based buffer overflow in the tcp_test function in aireplay-ng.c in Aircrack-ng before 1.2 RC 1 allows remote attackers to execute arbi

    CriticalCVSS 9.8Proof of conceptEPSS 23%

    aircrack-ng · aircrack-ngJan 31, 2020

  • CVE-2020-8512
    28Monitor

    In IceWarp Webmail Server through 11.4.4.1, there is XSS in the /webmail/ color parameter.

    MediumCVSS 6.1Proof of conceptEPSS 14%

    icewarp · icewarp serverJan 31, 2020