# CVEs published 2020-03-05

89 CVEs were published on March 5, 2020: 0 critical, 4 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2020-10184](https://cve.now/CVE-2020-10184.md): The verify endpoint in YubiKey Validation Server before 2.40 does not check the length of SQL queries, which allows remote attackers to caus (no CVSS)
- [CVE-2020-10185](https://cve.now/CVE-2020-10185.md): The sync endpoint in YubiKey Validation Server before 2.40 allows remote attackers to replay an OTP. (no CVSS)
- [CVE-2020-6986](https://cve.now/CVE-2020-6986.md): In all versions of Omron PLC CJ Series, an attacker can send a series of specific data packets within a short period, causing a service erro (CVSS 7.5, Omron PLC CJ Series)
- [CVE-2020-6971](https://cve.now/CVE-2020-6971.md): In Emerson ValveLink v12.0.264 to v13.4.118, a vulnerability in the ValveLink software may allow a local, unprivileged, trusted insider to e (no CVSS, Emerson ValveLink)
- [CVE-2020-5957](https://cve.now/CVE-2020-5957.md): NVIDIA Windows GPU Display Driver, all versions, contains a vulnerability in the NVIDIA Control Panel component in which an attacker with lo (no CVSS, NVIDIA GPU Display Driver)
- [CVE-2019-17646](https://cve.now/CVE-2019-17646.md): An issue was discovered in Centreon before 18.10.8, 19.04.5, and 19.10.2. (no CVSS)
- [CVE-2019-17647](https://cve.now/CVE-2019-17647.md): An issue was discovered in Centreon before 2.8.30, 18.10.8, 19.04.5, and 19.10.2. (no CVSS)
- [CVE-2019-20502](https://cve.now/CVE-2019-20502.md): An issue was discovered in EFS Easy Chat Server 3.1. (no CVSS)
- [CVE-2020-5405](https://cve.now/CVE-2020-5405.md): Directory Traversal with spring-cloud-config-server (no CVSS, Spring by VMware Spring Cloud Config · org.springframework.…)
- [CVE-2020-4082](https://cve.now/CVE-2020-4082.md): The HCL Connections 5.5 help system is vulnerable to cross-site scripting, caused by improper validation of user-supplied input. (no CVSS, HCL Software "HCL Connections")
- [CVE-2020-10180](https://cve.now/CVE-2020-10180.md): The ESET AV parsing engine allows virus-detection bypass via a crafted BZ2 Checksum field in an archive. (no CVSS)
- [CVE-2020-4083](https://cve.now/CVE-2020-4083.md): HCL Connections 6.5 is vulnerable to possible information leakage. (no CVSS, HCL Software "HCL Connections")
- [CVE-2019-20382](https://cve.now/CVE-2019-20382.md): QEMU 4.1.0 has a memory leak in zrle\_compress\_data in ui/vnc-enc-zrle.c during a VNC disconnect operation because libz is misused, resulting (no CVSS)
- [CVE-2020-5250](https://cve.now/CVE-2020-5250.md): Possible information disclosure in PrestaShop (CVSS 7.6, PrestaShop)
- [CVE-2019-17642](https://cve.now/CVE-2019-17642.md): An issue was discovered in Centreon before 18.10.8, 19.10.1, and 19.04.2. (no CVSS)
- [CVE-2019-17645](https://cve.now/CVE-2019-17645.md): An issue was discovered in Centreon before 2.8.31, 18.10.9, 19.04.6, and 19.10.3. (no CVSS)
- [CVE-2020-8994](https://cve.now/CVE-2020-8994.md): An issue was discovered on XIAOMI AI speaker MDZ-25-DT 1.34.36, and 1.40.14. (no CVSS)
- [CVE-2020-10174](https://cve.now/CVE-2020-10174.md): init\_tmp in TeeJee.FileSystem.vala in Timeshift before 20.03 unsafely reuses a preexisting temporary directory in the predictable location / (no CVSS)
- [CVE-2020-9418](https://cve.now/CVE-2020-9418.md): An untrusted search path vulnerability in the installer of PDFescape Desktop version 4.0.22 and earlier allows an attacker to gain privilege (no CVSS)
- [CVE-2020-4278](https://cve.now/CVE-2020-4278.md): IBM Platform LSF 9.1 and 10.1, IBM Spectrum LSF Suite 10.2, and IBM Spectrum Suite for HPA 10.2 could allow a local user to escalate their p (CVSS 7.4, IBM Spectrum LSF · IBM Spectrum Computing Suite for High Pe…)
- [CVE-2020-9544](https://cve.now/CVE-2020-9544.md): An issue was discovered on D-Link DSL-2640B E1 EU\_1.01 devices. (no CVSS)
- [CVE-2020-9402](https://cve.now/CVE-2020-9402.md): Django 1.11 before 1.11.29, 2.2 before 2.2.11, and 3.0 before 3.0.4 allows SQL Injection if untrusted data is used as a tolerance parameter (no CVSS, django)
- [CVE-2019-20499](https://cve.now/CVE-2019-20499.md): D-Link DWL-2600AP 4.2.0.15 Rev A devices have an authenticated OS command injection vulnerability via the Restore Configuration functionalit (no CVSS)
- [CVE-2019-20500](https://cve.now/CVE-2019-20500.md): D-Link DWL-2600AP 4.2.0.15 Rev A devices have an authenticated OS command injection vulnerability via the Save Configuration functionality i (CVSS 7.8, KEV)
- [CVE-2020-10173](https://cve.now/CVE-2020-10173.md): Comtrend VR-3033 DE11-416SSG-C01\_R02.A2pvI042j1.d26m devices have Multiple Authenticated Command Injection vulnerabilities via the ping and (no CVSS)
- [CVE-2019-20501](https://cve.now/CVE-2019-20501.md): D-Link DWL-2600AP 4.2.0.15 Rev A devices have an authenticated OS command injection vulnerability via the Upgrade Firmware functionality in (no CVSS)
- [CVE-2019-20107](https://cve.now/CVE-2019-20107.md): Multiple SQL injection vulnerabilities in TestLink through 1.9.19 allows remote authenticated users to execute arbitrary SQL commands via th (no CVSS)
- [CVE-2020-9380](https://cve.now/CVE-2020-9380.md): IPTV Smarters WEB TV PLAYER through 2020-02-22 allows attackers to execute OS commands by uploading a script. (no CVSS)
- [CVE-2020-10107](https://cve.now/CVE-2020-10107.md): PHPGurukul Daily Expense Tracker System 1.0 is vulnerable to stored XSS, as demonstrated by the ExpenseItem or ExpenseCost parameter in mana (no CVSS)
- [CVE-2020-10106](https://cve.now/CVE-2020-10106.md): PHPGurukul Daily Expense Tracker System 1.0 is vulnerable to SQL injection, as demonstrated by the email parameter in index.php or register. (no CVSS)
- [CVE-2020-9370](https://cve.now/CVE-2020-9370.md): HUMAX HGA12R-02 BRGCAA 1.1.53 devices allow Session Hijacking. (no CVSS)
- [CVE-2019-2317](https://cve.now/CVE-2019-2317.md): The secret key used to make the Initial Sequence Number in the TCP SYN packet could be brute forced and therefore can be predicted in Snapdr (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2019-14098](https://cve.now/CVE-2019-14098.md): Possible buffer overflow in data offload handler due to lack of check of keydata length when copying data in Snapdragon Auto, Snapdragon Com (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2019-2300](https://cve.now/CVE-2019-2300.md): Possible buffer overflow in WLAN handler due to lack of validation of destination buffer size before copying into it in Snapdragon Auto, Sna (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2019-2311](https://cve.now/CVE-2019-2311.md): Possible buffer overflow in WLAN handler due to lack of validation of destination buffer size before copying it in Snapdragon Auto, Snapdrag (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2019-14095](https://cve.now/CVE-2019-14095.md): Buffer overflow occurs while processing LMP packet in which name length parameter exceeds value specified in BT-specification in Snapdragon (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2019-14097](https://cve.now/CVE-2019-14097.md): Possible buffer overflow in WLAN Parser due to lack of length check when copying data in Snapdragon Auto, Snapdragon Compute, Snapdragon Con (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2019-14083](https://cve.now/CVE-2019-14083.md): While parsing Service Descriptor Extended Attribute received as part of SDF frame, there is a possibility that incorrect length is specified (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2019-14085](https://cve.now/CVE-2019-14085.md): Possible Integer underflow in WLAN function due to lack of check of data received from user side in Snapdragon Auto, Snapdragon Compute, Sna (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2019-14086](https://cve.now/CVE-2019-14086.md): Possible integer overflow while checking the length of frame which is a 32 bit integer and is added to another 32 bit integer which can lead (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2019-14081](https://cve.now/CVE-2019-14081.md): Buffer Over-read when WLAN module gets a WMI message for SAR limits with invalid number of limits to be enforced in Snapdragon Compute, Snap (no CVSS, Qualcomm Snapdragon Compute, Snapdragon Consumer Electronic…)
- [CVE-2019-14082](https://cve.now/CVE-2019-14082.md): Potential buffer over-read due to lack of bound check of memory offset passed in WLAN firmware in Snapdragon Compute, Snapdragon Consumer El (no CVSS, Qualcomm Snapdragon Compute, Snapdragon Consumer Electronic…)
- [CVE-2019-14071](https://cve.now/CVE-2019-14071.md): Compromised reset handler may bypass access control due to AC config is being reset if debug path is enabled to collect secure or non-secure (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2019-14072](https://cve.now/CVE-2019-14072.md): Unhandled paging request is observed due to dereferencing an already freed object because of race condition between sparse free and sparse b (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2019-14079](https://cve.now/CVE-2019-14079.md): Access to the uninitialized variable when the driver tries to unmap the dma buffer of a request which was never mapped in the first place le (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2019-14061](https://cve.now/CVE-2019-14061.md): Null-pointer dereference can occur while accessing the segment element info when it is not allocated and assigned in Snapdragon Auto, Snapdr (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2019-14068](https://cve.now/CVE-2019-14068.md): Out of bound access in msm routing due to lack of check of size before accessing in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2019-14045](https://cve.now/CVE-2019-14045.md): Possible buffer overflow while processing clientlog and serverlog due to lack of validation of data received in logs in Snapdragon Auto, Sna (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Consumer IOT, Snapdrag…)
- [CVE-2019-14048](https://cve.now/CVE-2019-14048.md): Possible out of bound memory access while playing a crafted clip in media player in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2019-14050](https://cve.now/CVE-2019-14050.md): Out-of-bound writes occurs due to lack of check of buffer size will cause buffer overflow only in 32bit architecture. (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2019-14031](https://cve.now/CVE-2019-14031.md): Buffer overflow can occur while parsing RSN IE containing list of PMK ID\`s which are more than the buffer size in Snapdragon Auto, Snapdrago (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2019-14032](https://cve.now/CVE-2019-14032.md): Memory use after free issue in audio due to lack of resource control in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdr (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2019-14028](https://cve.now/CVE-2019-14028.md): Buffer overwrite during memcpy due to lack of check on SSID length validation in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivit (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2019-14029](https://cve.now/CVE-2019-14029.md): Use-after-free in graphics module due to destroying already queued syncobj in error case in Snapdragon Auto, Snapdragon Compute, Snapdragon (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2019-14030](https://cve.now/CVE-2019-14030.md): The size of a buffer is determined by addition and multiplications operations that have the potential to overflow due to lack of bound check (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2019-14026](https://cve.now/CVE-2019-14026.md): Possible buffer overflow in WLAN WMI handler due to lack of ssid length check when copying data in Snapdragon Auto, Snapdragon Compute, Snap (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2019-14027](https://cve.now/CVE-2019-14027.md): Buffer overflow due to lack of upper bound check on channel length which is used for a loop. (no CVSS, Qualcomm Snapdragon Compute, Snapdragon Connectivity, Snapd…)
- [CVE-2019-10616](https://cve.now/CVE-2019-10616.md): Possibility of null pointer access if the SPDM commands are executed in the non-standard way in TZ. (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2019-14000](https://cve.now/CVE-2019-14000.md): Lack of check that the RX FIFO write index that is read from shared RAM is less than the FIFO size results into memory corruption and potent (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2019-14015](https://cve.now/CVE-2019-14015.md): A stack-based buffer overflow exists in the initialization of the identification stage due to lack of check on the number of templates provi (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2019-10604](https://cve.now/CVE-2019-10604.md): Possibility of heap-buffer-overflow during last iteration of loop while populating image version information in diag command response packet (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Consumer IOT, Snapdrag…)
- [CVE-2019-10612](https://cve.now/CVE-2019-10612.md): UTCB object has a function pointer called by the reaper to deallocate its memory resources and this address can potentially be corrupted by (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2019-10593](https://cve.now/CVE-2019-10593.md): Buffer overflow can occur when processing non standard SDP video Image attribute parameter in a VILTE\\VOLTE call in Snapdragon Auto, Snapdra (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2019-10594](https://cve.now/CVE-2019-10594.md): Stack overflow can occur when SDP is received with multiple payload types in the FMTP attribute of a video M line in Snapdragon Auto, Snapdr (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2019-10603](https://cve.now/CVE-2019-10603.md): Use after free issue occurs If the real device interface goes down and a route lookup is performed while sending a raw IPv6 message in Snapd (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2019-10587](https://cve.now/CVE-2019-10587.md): Possible Stack overflow can occur when processing a large SDP body or non standard SDP body without right delimiters in Snapdragon Auto, Sna (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2019-10591](https://cve.now/CVE-2019-10591.md): Null pointer dereference can happen when parsing udta atom which is non-standard and having invalid depth in Snapdragon Auto, Snapdragon Com (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2019-10577](https://cve.now/CVE-2019-10577.md): Improper input validation while processing SIP URI received from the network will lead to buffer over-read and then to denial of service in (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2019-10586](https://cve.now/CVE-2019-10586.md): Filling media attribute tag names without validating the destination buffer size which can result in the buffer overflow in Snapdragon Auto, (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2019-10553](https://cve.now/CVE-2019-10553.md): Multiple Read overflows due to improper length checks while decoding authentication in Cs domain/RAU Reject and TC cmd in Snapdragon Auto, S (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2019-10554](https://cve.now/CVE-2019-10554.md): Multiple Read overflows issue due to improper length check while decoding Identity Request in CSdomain/Authentication Reject in CS domain/ P (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2019-10569](https://cve.now/CVE-2019-10569.md): Stack buffer overflow due to instance id is misplaced inside definition of hardware accelerated effects in makefile in Snapdragon Auto, Snap (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2019-10550](https://cve.now/CVE-2019-10550.md): Buffer Over-read when UE is trying to process the message received form the network without zero termination in Snapdragon Auto, Snapdragon (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2019-10552](https://cve.now/CVE-2019-10552.md): Multiple Buffer Over-read issue can happen due to improper length checks while decoding Service Reject/RAU Reject/PTMSI Realloc cmd in Snapd (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2019-10526](https://cve.now/CVE-2019-10526.md): Out of bound write in WLAN driver due to NULL character not properly placed after SSID name in Snapdragon Auto, Snapdragon Compute, Snapdrag (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2019-10546](https://cve.now/CVE-2019-10546.md): Buffer overflow can occur in WLAN firmware while parsing beacon/probe\_response frames during roaming in Snapdragon Auto, Snapdragon Compute, (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2019-10549](https://cve.now/CVE-2019-10549.md): Null pointer dereference issue can happen due to improper validation of CSEQ header response received from network in Snapdragon Auto, Snapd (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2018-11838](https://cve.now/CVE-2018-11838.md): Possible double free issue in WLAN due to lack of checking memory free condition. (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2020-10096](https://cve.now/CVE-2020-10096.md): An issue was discovered in Zammad 3.0 through 3.2. (no CVSS)
- [CVE-2020-10097](https://cve.now/CVE-2020-10097.md): An issue was discovered in Zammad 3.0 through 3.2. (no CVSS)
- [CVE-2020-10098](https://cve.now/CVE-2020-10098.md): An XSS issue was discovered in Zammad 3.0 through 3.2. (no CVSS)
- [CVE-2020-10099](https://cve.now/CVE-2020-10099.md): An XSS issue was discovered in Zammad 3.0 through 3.2. (no CVSS)
- [CVE-2020-10100](https://cve.now/CVE-2020-10100.md): An issue was discovered in Zammad 3.0 through 3.2. (no CVSS)
- [CVE-2020-10101](https://cve.now/CVE-2020-10101.md): An issue was discovered in Zammad 3.0 through 3.2. (no CVSS)
- [CVE-2020-10102](https://cve.now/CVE-2020-10102.md): An issue was discovered in Zammad 3.0 through 3.2. (no CVSS)
- [CVE-2020-10103](https://cve.now/CVE-2020-10103.md): An XSS issue was discovered in Zammad 3.0 through 3.2. (no CVSS)
- [CVE-2020-10104](https://cve.now/CVE-2020-10104.md): An issue was discovered in Zammad 3.0 through 3.2. (no CVSS)
- [CVE-2020-10105](https://cve.now/CVE-2020-10105.md): An issue was discovered in Zammad 3.0 through 3.2. (no CVSS)
- [CVE-2019-14886](https://cve.now/CVE-2019-14886.md): A vulnerability was found in business-central, as shipped in rhdm-7.5.1 and rhpam-7.5.1, where encoded passwords are stored in errai\_securit (CVSS 4.6, Red Hat Business-central)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2020-03-05
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.