CVEs published March 2, 2020
58 CVEs were published on March 2, 2020: 4 critical, 6 high. 1 is now in CISA KEV.
- Published
- 58
- Critical
- 4
- High
- 6
- Medium
- 3
- Low
- 2
- Unrated
- 43
- Now in CISA KEV
- 1
- Fix available
- 23
Most affected products
- Mozilla Thunderbird
- 4
- com.fasterxml.jackson.core:jackson-databind
- 3
- Mozilla Firefox
- 3
- Mozilla Thunderbird · Mozilla Firefox
- 3
- IBM Security Information Queue
- 2
- Red Hat jackson-databind · com.fasterxml.jackson.core:jacks…
- 2
- SUSE Linux Enterprise Server
- 2
- SUSE Linux Enterprise Server · openSUSE Leap +1
- 2
- github.com/influxdata/influxdb
- 1
- GRANDIT
- 1
Critical 4
- CVE-2020-1731A flaw was found in all versions of the Keycloak operator, before version 8.0.2,(community only) where the operator generates a random adminRed Hat keycloak · org.keycloak:keycloak-core
- CVE-2020-9546FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.hacom.fasterxml.jackson.core:jackson-databind
- CVE-2020-9547FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to com.ibatis.sqcom.fasterxml.jackson.core:jackson-databind
- CVE-2020-9548FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to br.com.anterocom.fasterxml.jackson.core:jackson-databind
High 6
- CVE-2019-14893A flaw was discovered in FasterXML jackson-databind in all versions before 2.9.10 and 2.10.0, where it would permit polymorphic deserializatRed Hat jackson-databind · com.fasterxml.jackson.core:jacks…
- CVE-2019-18903wicked: Use-after-free when receiving invalid DHCP6 IA_PD optionSUSE Linux Enterprise Server · openSUSE Leap +1
- CVE-2019-18902wicked: Use-after-free when receiving invalid DHCP6 client optionsSUSE Linux Enterprise Server · openSUSE Leap +1
- CVE-2019-14892A flaw was discovered in jackson-databind in versions before 2.9.10, 2.8.11.5 and 2.6.7.3, where it would permit polymorphic deserializationRed Hat jackson-databind · com.fasterxml.jackson.core:jacks…
- CVE-2019-18897Local privilege escalation from user salt to rootSUSE Linux Enterprise Server · openSUSE Factory
- CVE-2019-17026Incorrect alias information in IonMonkey JIT compiler for setting array elements could lead to a type confusion.Mozilla Firefox ESR · Mozilla Thunderbird +1
Medium, low and unrated 48
- CVE-2020-10018WebKitGTK through 2.26.4 and WPE WebKit through 2.26.4 (which are the versions right before 2.28.0) contains a memory corruption issue (use-
- CVE-2018-5951An issue was discovered in Mikrotik RouterOS.
- CVE-2018-20343Multiple buffer overflow vulnerabilities have been found in Ken Silverman Build Engine 1.
- CVE-2018-19798Fleetco Fleet Maintenance Management (FMM) 1.2 and earlier allows uploading an arbitrary ".php" file with the application/x-php Content-Type
- CVE-2018-19658The Markdown editor in YXBJ before 8.3.2 on macOS has stored XSS.
- CVE-2018-19599Monstra CMS 1.6 allows XSS via an uploaded SVG document to the admin/index.php?id=filesmanager&path=uploads/ URI.
- CVE-2018-17572InfluxDB 0.9.5 has Reflected XSS in the Write Data module.github.com/influxdata/influxdb
- CVE-2018-16357An issue was discovered in PbootCMS.
- CVE-2018-16356An issue was discovered in PbootCMS.
- CVE-2020-8437The bencoding parser in BitTorrent uTorrent through 3.5.5 (build 45505) misparses nested bencoded dictionaries, which allows a remote attack
- CVE-2020-8778Alfresco Enterprise before 5.2.7 and Alfresco Community before 6.2.0 (rb65251d6-b368) has XSS via an uploaded document, when the attacker ha
- CVE-2020-8777Alfresco Enterprise before 5.2.7 and Alfresco Community before 6.2.0 (rb65251d6-b368) has XSS via a user profile photo, as demonstrated by a
- CVE-2020-8776Alfresco Enterprise before 5.2.7 and Alfresco Community before 6.2.0 (rb65251d6-b368) has XSS via the URL property of a file.
- CVE-2018-15820EasyIO EasyIO-30P devices before 2.0.5.27 allow XSS via the dev.htm GDN parameter.
- CVE-2018-15819EasyIO EasyIO-30P devices before 2.0.5.27 have Incorrect Access Control, related to webuser.js.
- CVE-2019-19608A SQL injection vulnerability in in the web conferencing component of Mitel MiCollab AWV before 8.1.2.2 could allow an unauthenticated attac
- CVE-2019-19607A SQL injection vulnerability in the web conferencing component of Mitel MiCollab AWV before 8.1.2.2 could allow an unauthenticated attack d
- CVE-2019-19371A cross-site scripting (XSS) vulnerability in the web conferencing component of Mitel MiCollab AWV before 8.1.2.2 could allow an unauthentic
- CVE-2019-19370A cross-site scripting (XSS) vulnerability in the web conferencing component of the Mitel MiCollab application before 9.0.15 for Android cou
- CVE-2019-18863A key length vulnerability in the implementation of the SRTP 128-bit key on Mitel 6800 and 6900 SIP series phones, versions 5.1.0.2051 SP2 a
- CVE-2020-8013permissions: chkstat sets unintended setuid/capabilities for mrsh and wodimSUSE Linux Enterprise Server
- CVE-2018-14384The Website Manager module in SEO Panel 3.13.0 and earlier is affected by a stored Cross-Site Scripting (XSS) vulnerability, allowing remote
- CVE-2019-18901mysql-systemd-helper allows setting 640 permissions of arbitrary filesSUSE Linux Enterprise Server
- CVE-2017-12580An issue was discovered in IDM UltraEdit through 24.10.0.32.
- CVE-2015-1583Multiple cross-site request forgery (CSRF) vulnerabilities in ATutor 2.2 allow remote attackers to hijack the authentication of administrato
- CVE-2020-5249HTTP Response Splitting (Early Hints) in PumaPuma
- CVE-2019-12183Incorrect Access Control in Safescan Timemoto TM-616 and TA-8000 series allows remote attackers to read any file via the administrative API.
- CVE-2019-20486An issue was discovered on NETGEAR WNR1000V4 1.1.0.54 devices.
- CVE-2019-20488An issue was discovered on NETGEAR WNR1000V4 1.1.0.54 devices.
- CVE-2019-20489An issue was discovered on NETGEAR WNR1000V4 1.1.0.54 devices.
- CVE-2019-20487An issue was discovered on NETGEAR WNR1000V4 1.1.0.54 devices.
- CVE-2020-8500In Artica Pandora FMS 7.42, Web Admin users can execute arbitrary code by uploading a .php file via the Updater or Extension component.
- CVE-2020-4292IBM Security Information Queue (ISIQ) 1.0.0, 1.0.1, 1.0.2, 1.0.3, and 1.0.4 uses a cross-domain policy file that includes domains that shoulIBM Security Information Queue
- CVE-2020-4283IBM Security Information Queue (ISIQ) 1.0.0, 1.0.1, 1.0.2, 1.0.3, and 1.0.4 contains hard-coded credentials, such as a password or cryptograIBM Security Information Queue
- CVE-2018-17058An issue was discovered in JABA XPress Online Shop through 2018-09-14.
- CVE-2020-5539GRANDIT Ver.1.6, Ver.2.0, Ver.2.1, Ver.2.2, Ver.2.3, and Ver.3.0 do not properly manage sessions, which allows remote attackers to impersonaGRANDIT
- CVE-2020-9549In PDFResurrect 0.12 through 0.19, get_type in pdf.c has an out-of-bounds write via a crafted PDF document.
- CVE-2020-6792When deriving an identifier for an email message, uninitialized memory was used in addition to the message contents.Mozilla Thunderbird
- CVE-2020-6793When processing an email message with an ill-formed envelope, Thunderbird could read data from a random memory location.Mozilla Thunderbird
- CVE-2020-6794If a user saved passwords before Thunderbird 60 and then later set a master password, an unencrypted copy of these passwords is still accessMozilla Thunderbird
- CVE-2020-6795When processing a message that contains multiple S/MIME signatures, a bug in the MIME processing code caused a null pointer dereference, leaMozilla Thunderbird
- CVE-2020-6796A content process could have modified shared memory relating to crash reporting information, crash itself, and cause an out-of-bound write.Mozilla Firefox
- CVE-2020-6797By downloading a file with the .fileloc extension, a semi-privileged extension could launch an arbitrary application on the user's computer.Mozilla Thunderbird · Mozilla Firefox
- CVE-2020-6798If a template tag was used in a select tag, the parser could be confused and allow JavaScript parsing and execution when it should not be alMozilla Thunderbird · Mozilla Firefox
- CVE-2020-6799Command line arguments could have been injected during Firefox invocation as a shell handler for certain unsupported file types.Mozilla Firefox
- CVE-2020-6800Mozilla developers and community members reported memory safety bugs present in Firefox 72 and Firefox ESR 68.4.Mozilla Thunderbird · Mozilla Firefox
- CVE-2020-6801Mozilla developers reported memory safety bugs present in Firefox 72.Mozilla Firefox
- CVE-2020-9545Pale Moon 28.x before 28.8.4 has a segmentation fault related to module scripting, as demonstrated by a Lacoste web site.