# CVEs published 2020-03-04 41 CVEs were published on March 4, 2020: 1 critical, 5 high. 1 is now in CISA KEV. Days are UTC. - [CVE-2019-17644](https://cve.now/CVE-2019-17644.md): An issue was discovered in Centreon before 2.8-30, 18.10-8, 19.04-5, and 19.10-2.. (no CVSS) - [CVE-2019-17643](https://cve.now/CVE-2019-17643.md): An issue was discovered in Centreon before 2.8-30,18.10-8, 19.04-5, and 19.10-2. (no CVSS) - [CVE-2020-8660](https://cve.now/CVE-2020-8660.md): CNCF Envoy through 1.13.0 TLS inspector bypass. (no CVSS) - [CVE-2020-8664](https://cve.now/CVE-2020-8664.md): CNCF Envoy through 1.13.0 has incorrect Access Control when using SDS with Combined Validation Context. (no CVSS) - [CVE-2020-8661](https://cve.now/CVE-2020-8661.md): CNCF Envoy through 1.13.0 may consume excessive amounts of memory when responding internally to pipelined requests. (no CVSS) - [CVE-2020-8659](https://cve.now/CVE-2020-8659.md): CNCF Envoy through 1.13.0 may consume excessive amounts of memory when proxying HTTP/1.1 requests or responses with many small (i.e. (no CVSS) - [CVE-2020-7130](https://cve.now/CVE-2020-7130.md): HPE OneView Global Dashboard (OVGD) 1.9 has a remote information disclosure vulnerability. (no CVSS, HPE OneView Global Dashboard) - [CVE-2020-9054](https://cve.now/CVE-2020-9054.md): ZyXEL NAS products running firmware version 5.21 and earlier are vulnerable to pre-authentication command injection in weblogin.cgi (CVSS 9.8, KEV, ZyXEL NAS326 · ZyXEL NAS520 +11) - [CVE-2020-3176](https://cve.now/CVE-2020-3176.md): Cisco Remote PHY Device Software Command Injection Vulnerability (CVSS 6.7, Cisco Remote PHY) - [CVE-2020-3164](https://cve.now/CVE-2020-3164.md): Cisco ESA, Cisco WSA, and Cisco SMA GUI Denial of Service Vulnerability (CVSS 5.3, Cisco Web Security Appliance) - [CVE-2020-3157](https://cve.now/CVE-2020-3157.md): Cisco Identity Services Engine Cross-Site Scripting Vulnerability (CVSS 5.4, Cisco Identity Services Engine Software) - [CVE-2020-3155](https://cve.now/CVE-2020-3155.md): Cisco Intelligent Proximity SSL Certificate Validation Vulnerability (CVSS 7.4, Cisco Jabber IM for Android) - [CVE-2020-3148](https://cve.now/CVE-2020-3148.md): Cisco Prime Network Registrar Cross-Site Request Forgery Vulnerability (CVSS 7.1, Cisco Prime Network Registrar) - [CVE-2020-3128](https://cve.now/CVE-2020-3128.md): Cisco Webex Network Recording Player and Cisco Webex Player Arbitrary Code Execution Vulnerabilities (CVSS 7.8, Cisco WebEx WRF Player) - [CVE-2020-3127](https://cve.now/CVE-2020-3127.md): Cisco Webex Network Recording Player and Cisco Webex Player Arbitrary Code Execution Vulnerabilities (CVSS 7.8, Cisco WebEx WRF Player) - [CVE-2020-3193](https://cve.now/CVE-2020-3193.md): Cisco Prime Collaboration Provisioning Information Disclosure Vulnerability (CVSS 5.3, Cisco Prime Collaboration Provisioning) - [CVE-2020-3192](https://cve.now/CVE-2020-3192.md): Cisco Prime Collaboration Provisioning Cross-Site Scripting Vulnerability (CVSS 6.1, Cisco Prime Collaboration Provisioning) - [CVE-2020-3190](https://cve.now/CVE-2020-3190.md): Cisco IOS XR Software IPsec Packet Processor Denial of Service Vulnerability (CVSS 5.8, Cisco IOS XR Software) - [CVE-2020-3185](https://cve.now/CVE-2020-3185.md): Cisco TelePresence Management Suite Stored Cross-Site Scripting Vulnerability (CVSS 4.8, Cisco TelePresence Management Suite) - [CVE-2020-3182](https://cve.now/CVE-2020-3182.md): Cisco Webex Meetings Client for MacOS Information Disclosure Vulnerability (CVSS 4.3, Cisco Webex Meetings) - [CVE-2020-3181](https://cve.now/CVE-2020-3181.md): Cisco Email Security Appliance Uncontrolled Resource Exhaustion Vulnerability (CVSS 6.5, Cisco Email Security Appliance) - [CVE-2020-9550](https://cve.now/CVE-2020-9550.md): Rubetek SmartHome 2020 devices use unencrypted 433 MHz communication between controllers and beacons, allowing an attacker to sniff and spoo (no CVSS) - [CVE-2020-9477](https://cve.now/CVE-2020-9477.md): An issue was discovered on HUMAX HGA12R-02 BRGCAA 1.1.53 devices. (no CVSS) - [CVE-2020-9476](https://cve.now/CVE-2020-9476.md): ARRIS TG1692A devices allow remote attackers to discover the administrator login name and password by reading the /login page and performing (no CVSS) - [CVE-2020-9372](https://cve.now/CVE-2020-9372.md): The Appointment Booking Calendar plugin before 1.3.35 for WordPress allows user input (in fields such as Description or Name) in any booking (no CVSS) - [CVE-2020-9371](https://cve.now/CVE-2020-9371.md): Stored XSS exists in the Appointment Booking Calendar plugin before 1.3.35 for WordPress. (no CVSS) - [CVE-2019-19226](https://cve.now/CVE-2019-19226.md): A Broken Access Control vulnerability in the D-Link DSL-2680 web administration interface (Firmware EU\_1.03) allows an attacker to enable or (no CVSS) - [CVE-2019-19225](https://cve.now/CVE-2019-19225.md): A Broken Access Control vulnerability in the D-Link DSL-2680 web administration interface (Firmware EU\_1.03) allows an attacker to change DN (no CVSS) - [CVE-2019-19224](https://cve.now/CVE-2019-19224.md): A Broken Access Control vulnerability in the D-Link DSL-2680 web administration interface (Firmware EU\_1.03) allows an attacker to download (no CVSS) - [CVE-2019-19223](https://cve.now/CVE-2019-19223.md): A Broken Access Control vulnerability in the D-Link DSL-2680 web administration interface (Firmware EU\_1.03) allows an attacker to reboot th (no CVSS) - [CVE-2019-19222](https://cve.now/CVE-2019-19222.md): A Stored XSS issue in the D-Link DSL-2680 web administration interface (Firmware EU\_1.03) allows an authenticated attacker to inject arbitra (no CVSS) - [CVE-2020-10057](https://cve.now/CVE-2020-10057.md): GeniXCMS 1.1.7 is vulnerable to user privilege escalation due to broken access control. (no CVSS) - [CVE-2020-7988](https://cve.now/CVE-2020-7988.md): An issue was discovered in tools/pass-change/result.php in phpIPAM 1.4. (no CVSS) - [CVE-2020-9761](https://cve.now/CVE-2020-9761.md): An issue was discovered in UNCTAD ASYCUDA World 2001 through 2020. (no CVSS) - [CVE-2020-9757](https://cve.now/CVE-2020-9757.md): The SEOmatic component before 3.3.0 for Craft CMS allows Server-Side Template Injection that leads to RCE via malformed data to the metacont (no CVSS, nystudio107/craft-seomatic) - [CVE-2020-9364](https://cve.now/CVE-2020-9364.md): An issue was discovered in helpers/mailer.php in the Creative Contact Form extension 4.6.2 before 2019-12-03 for Joomla!. (no CVSS) - [CVE-2020-5251](https://cve.now/CVE-2020-5251.md): Information disclosure in parse-server (CVSS 7.7, parse-community parse-server · parse-server) - [CVE-2019-3404](https://cve.now/CVE-2019-3404.md): By adding some special fields to the uri ofrouter app function, the user could abuse background app cgi functions withoutauthentication. (no CVSS, 360 Security Technology 360 Router F5C) - [CVE-2020-5535](https://cve.now/CVE-2020-5535.md): OpenBlocks IoT VX2 prior to Ver.4.0.0 (Ver.3 Series) allows an attacker on the same network segment to execute arbitrary OS commands with ro (no CVSS, Plat'Home Co. OpenBlocks IoT VX2) - [CVE-2020-5536](https://cve.now/CVE-2020-5536.md): OpenBlocks IoT VX2 prior to Ver.4.0.0 (Ver.3 Series) allows an attacker on the same network segment to bypass authentication and to initiali (no CVSS, Plat'Home Co. OpenBlocks IoT VX2) - [CVE-2020-10029](https://cve.now/CVE-2020-10029.md): The GNU C Library (aka glibc or libc6) before 2.32 could overflow an on-stack buffer during range reduction if an input to an 80-bit long do (no CVSS) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2020-03-04 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.