# CVEs published 2020-03-02

58 CVEs were published on March 2, 2020: 4 critical, 6 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2020-10018](https://cve.now/CVE-2020-10018.md): WebKitGTK through 2.26.4 and WPE WebKit through 2.26.4 (which are the versions right before 2.28.0) contains a memory corruption issue (use- (no CVSS)
- [CVE-2018-5951](https://cve.now/CVE-2018-5951.md): An issue was discovered in Mikrotik RouterOS. (no CVSS)
- [CVE-2018-20343](https://cve.now/CVE-2018-20343.md): Multiple buffer overflow vulnerabilities have been found in Ken Silverman Build Engine 1. (no CVSS)
- [CVE-2018-19798](https://cve.now/CVE-2018-19798.md): Fleetco Fleet Maintenance Management (FMM) 1.2 and earlier allows uploading an arbitrary ".php" file with the application/x-php Content-Type (no CVSS)
- [CVE-2019-14893](https://cve.now/CVE-2019-14893.md): A flaw was discovered in FasterXML jackson-databind in all versions before 2.9.10 and 2.10.0, where it would permit polymorphic deserializat (CVSS 7.5, Red Hat jackson-databind · com.fasterxml.jackson.core:jacks…)
- [CVE-2018-19658](https://cve.now/CVE-2018-19658.md): The Markdown editor in YXBJ before 8.3.2 on macOS has stored XSS. (no CVSS)
- [CVE-2018-19599](https://cve.now/CVE-2018-19599.md): Monstra CMS 1.6 allows XSS via an uploaded SVG document to the admin/index.php?id=filesmanager&path=uploads/ URI. (no CVSS)
- [CVE-2018-17572](https://cve.now/CVE-2018-17572.md): InfluxDB 0.9.5 has Reflected XSS in the Write Data module. (no CVSS, github.com/influxdata/influxdb)
- [CVE-2018-16357](https://cve.now/CVE-2018-16357.md): An issue was discovered in PbootCMS. (no CVSS)
- [CVE-2018-16356](https://cve.now/CVE-2018-16356.md): An issue was discovered in PbootCMS. (no CVSS)
- [CVE-2020-8437](https://cve.now/CVE-2020-8437.md): The bencoding parser in BitTorrent uTorrent through 3.5.5 (build 45505) misparses nested bencoded dictionaries, which allows a remote attack (no CVSS)
- [CVE-2020-8778](https://cve.now/CVE-2020-8778.md): Alfresco Enterprise before 5.2.7 and Alfresco Community before 6.2.0 (rb65251d6-b368) has XSS via an uploaded document, when the attacker ha (no CVSS)
- [CVE-2020-8777](https://cve.now/CVE-2020-8777.md): Alfresco Enterprise before 5.2.7 and Alfresco Community before 6.2.0 (rb65251d6-b368) has XSS via a user profile photo, as demonstrated by a (no CVSS)
- [CVE-2020-8776](https://cve.now/CVE-2020-8776.md): Alfresco Enterprise before 5.2.7 and Alfresco Community before 6.2.0 (rb65251d6-b368) has XSS via the URL property of a file. (no CVSS)
- [CVE-2018-15820](https://cve.now/CVE-2018-15820.md): EasyIO EasyIO-30P devices before 2.0.5.27 allow XSS via the dev.htm GDN parameter. (no CVSS)
- [CVE-2018-15819](https://cve.now/CVE-2018-15819.md): EasyIO EasyIO-30P devices before 2.0.5.27 have Incorrect Access Control, related to webuser.js. (no CVSS)
- [CVE-2019-19608](https://cve.now/CVE-2019-19608.md): A SQL injection vulnerability in in the web conferencing component of Mitel MiCollab AWV before 8.1.2.2 could allow an unauthenticated attac (no CVSS)
- [CVE-2019-19607](https://cve.now/CVE-2019-19607.md): A SQL injection vulnerability in the web conferencing component of Mitel MiCollab AWV before 8.1.2.2 could allow an unauthenticated attack d (no CVSS)
- [CVE-2019-19371](https://cve.now/CVE-2019-19371.md): A cross-site scripting (XSS) vulnerability in the web conferencing component of Mitel MiCollab AWV before 8.1.2.2 could allow an unauthentic (no CVSS)
- [CVE-2019-19370](https://cve.now/CVE-2019-19370.md): A cross-site scripting (XSS) vulnerability in the web conferencing component of the Mitel MiCollab application before 9.0.15 for Android cou (no CVSS)
- [CVE-2019-18863](https://cve.now/CVE-2019-18863.md): A key length vulnerability in the implementation of the SRTP 128-bit key on Mitel 6800 and 6900 SIP series phones, versions 5.1.0.2051 SP2 a (no CVSS)
- [CVE-2019-18903](https://cve.now/CVE-2019-18903.md): wicked: Use-after-free when receiving invalid DHCP6 IA\_PD option (CVSS 7.5, SUSE Linux Enterprise Server · openSUSE Leap +1)
- [CVE-2019-18902](https://cve.now/CVE-2019-18902.md): wicked: Use-after-free when receiving invalid DHCP6 client options (CVSS 7.5, SUSE Linux Enterprise Server · openSUSE Leap +1)
- [CVE-2020-8013](https://cve.now/CVE-2020-8013.md): permissions: chkstat sets unintended setuid/capabilities for mrsh and wodim (CVSS 2.2, SUSE Linux Enterprise Server)
- [CVE-2018-14384](https://cve.now/CVE-2018-14384.md): The Website Manager module in SEO Panel 3.13.0 and earlier is affected by a stored Cross-Site Scripting (XSS) vulnerability, allowing remote (no CVSS)
- [CVE-2019-14892](https://cve.now/CVE-2019-14892.md): A flaw was discovered in jackson-databind in versions before 2.9.10, 2.8.11.5 and 2.6.7.3, where it would permit polymorphic deserialization (CVSS 7.5, Red Hat jackson-databind · com.fasterxml.jackson.core:jacks…)
- [CVE-2020-1731](https://cve.now/CVE-2020-1731.md): A flaw was found in all versions of the Keycloak operator, before version 8.0.2,(community only) where the operator generates a random admin (CVSS 9.1, Red Hat keycloak · org.keycloak:keycloak-core)
- [CVE-2019-18901](https://cve.now/CVE-2019-18901.md): mysql-systemd-helper allows setting 640 permissions of arbitrary files (CVSS 5.1, SUSE Linux Enterprise Server)
- [CVE-2017-12580](https://cve.now/CVE-2017-12580.md): An issue was discovered in IDM UltraEdit through 24.10.0.32. (no CVSS)
- [CVE-2015-1583](https://cve.now/CVE-2015-1583.md): Multiple cross-site request forgery (CSRF) vulnerabilities in ATutor 2.2 allow remote attackers to hijack the authentication of administrato (no CVSS)
- [CVE-2019-18897](https://cve.now/CVE-2019-18897.md): Local privilege escalation from user salt to root (CVSS 8.4, SUSE Linux Enterprise Server · openSUSE Factory)
- [CVE-2020-5249](https://cve.now/CVE-2020-5249.md): HTTP Response Splitting (Early Hints) in Puma (CVSS 6.5, Puma)
- [CVE-2019-12183](https://cve.now/CVE-2019-12183.md): Incorrect Access Control in Safescan Timemoto TM-616 and TA-8000 series allows remote attackers to read any file via the administrative API. (no CVSS)
- [CVE-2019-20486](https://cve.now/CVE-2019-20486.md): An issue was discovered on NETGEAR WNR1000V4 1.1.0.54 devices. (no CVSS)
- [CVE-2019-20488](https://cve.now/CVE-2019-20488.md): An issue was discovered on NETGEAR WNR1000V4 1.1.0.54 devices. (no CVSS)
- [CVE-2019-20489](https://cve.now/CVE-2019-20489.md): An issue was discovered on NETGEAR WNR1000V4 1.1.0.54 devices. (no CVSS)
- [CVE-2019-20487](https://cve.now/CVE-2019-20487.md): An issue was discovered on NETGEAR WNR1000V4 1.1.0.54 devices. (no CVSS)
- [CVE-2020-8500](https://cve.now/CVE-2020-8500.md): In Artica Pandora FMS 7.42, Web Admin users can execute arbitrary code by uploading a .php file via the Updater or Extension component. (no CVSS)
- [CVE-2020-4292](https://cve.now/CVE-2020-4292.md): IBM Security Information Queue (ISIQ) 1.0.0, 1.0.1, 1.0.2, 1.0.3, and 1.0.4 uses a cross-domain policy file that includes domains that shoul (CVSS 3.7, IBM Security Information Queue)
- [CVE-2020-4283](https://cve.now/CVE-2020-4283.md): IBM Security Information Queue (ISIQ) 1.0.0, 1.0.1, 1.0.2, 1.0.3, and 1.0.4 contains hard-coded credentials, such as a password or cryptogra (CVSS 6.8, IBM Security Information Queue)
- [CVE-2018-17058](https://cve.now/CVE-2018-17058.md): An issue was discovered in JABA XPress Online Shop through 2018-09-14. (no CVSS)
- [CVE-2020-5539](https://cve.now/CVE-2020-5539.md): GRANDIT Ver.1.6, Ver.2.0, Ver.2.1, Ver.2.2, Ver.2.3, and Ver.3.0 do not properly manage sessions, which allows remote attackers to impersona (no CVSS, GRANDIT)
- [CVE-2020-9549](https://cve.now/CVE-2020-9549.md): In PDFResurrect 0.12 through 0.19, get\_type in pdf.c has an out-of-bounds write via a crafted PDF document. (no CVSS)
- [CVE-2019-17026](https://cve.now/CVE-2019-17026.md): Incorrect alias information in IonMonkey JIT compiler for setting array elements could lead to a type confusion. (CVSS 8.8, KEV, Mozilla Firefox ESR · Mozilla Thunderbird +1)
- [CVE-2020-6792](https://cve.now/CVE-2020-6792.md): When deriving an identifier for an email message, uninitialized memory was used in addition to the message contents. (no CVSS, Mozilla Thunderbird)
- [CVE-2020-6793](https://cve.now/CVE-2020-6793.md): When processing an email message with an ill-formed envelope, Thunderbird could read data from a random memory location. (no CVSS, Mozilla Thunderbird)
- [CVE-2020-6794](https://cve.now/CVE-2020-6794.md): If a user saved passwords before Thunderbird 60 and then later set a master password, an unencrypted copy of these passwords is still access (no CVSS, Mozilla Thunderbird)
- [CVE-2020-6795](https://cve.now/CVE-2020-6795.md): When processing a message that contains multiple S/MIME signatures, a bug in the MIME processing code caused a null pointer dereference, lea (no CVSS, Mozilla Thunderbird)
- [CVE-2020-6796](https://cve.now/CVE-2020-6796.md): A content process could have modified shared memory relating to crash reporting information, crash itself, and cause an out-of-bound write. (no CVSS, Mozilla Firefox)
- [CVE-2020-6797](https://cve.now/CVE-2020-6797.md): By downloading a file with the .fileloc extension, a semi-privileged extension could launch an arbitrary application on the user's computer. (no CVSS, Mozilla Thunderbird · Mozilla Firefox)
- [CVE-2020-6798](https://cve.now/CVE-2020-6798.md): If a template tag was used in a select tag, the parser could be confused and allow JavaScript parsing and execution when it should not be al (no CVSS, Mozilla Thunderbird · Mozilla Firefox)
- [CVE-2020-6799](https://cve.now/CVE-2020-6799.md): Command line arguments could have been injected during Firefox invocation as a shell handler for certain unsupported file types. (no CVSS, Mozilla Firefox)
- [CVE-2020-6800](https://cve.now/CVE-2020-6800.md): Mozilla developers and community members reported memory safety bugs present in Firefox 72 and Firefox ESR 68.4. (no CVSS, Mozilla Thunderbird · Mozilla Firefox)
- [CVE-2020-6801](https://cve.now/CVE-2020-6801.md): Mozilla developers reported memory safety bugs present in Firefox 72. (no CVSS, Mozilla Firefox)
- [CVE-2020-9546](https://cve.now/CVE-2020-9546.md): FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.ha (CVSS 9.8, com.fasterxml.jackson.core:jackson-databind)
- [CVE-2020-9547](https://cve.now/CVE-2020-9547.md): FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to com.ibatis.sq (CVSS 9.8, com.fasterxml.jackson.core:jackson-databind)
- [CVE-2020-9548](https://cve.now/CVE-2020-9548.md): FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to br.com.antero (CVSS 9.8, com.fasterxml.jackson.core:jackson-databind)
- [CVE-2020-9545](https://cve.now/CVE-2020-9545.md): Pale Moon 28.x before 28.8.4 has a segmentation fault related to module scripting, as demonstrated by a Lacoste web site. (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2020-03-02
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.