# CVEs published 2020-03-06

24 CVEs were published on March 6, 2020: 2 critical, 1 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2020-8634](https://cve.now/CVE-2020-8634.md): Wing FTP Server v6.2.3 for Linux, macOS, and Solaris sets insecure permissions on files modified within the HTTP file management interface, (no CVSS)
- [CVE-2020-8635](https://cve.now/CVE-2020-8635.md): Wing FTP Server v6.2.3 for Linux, macOS, and Solaris sets insecure permissions on installation directories and configuration files. (no CVSS)
- [CVE-2020-10212](https://cve.now/CVE-2020-10212.md): upload.php in Responsive FileManager 9.13.4 and 9.14.0 allows SSRF via the url parameter because file-extension blocking is mishandled and b (no CVSS)
- [CVE-2019-19772](https://cve.now/CVE-2019-19772.md): Various Lexmark products have reflected XSS in the embedded web server used in older generation Lexmark devices. (no CVSS)
- [CVE-2019-19773](https://cve.now/CVE-2019-19773.md): Various Lexmark products have stored XSS in the embedded web server used in older generation Lexmark devices. (no CVSS)
- [CVE-2020-10112](https://cve.now/CVE-2020-10112.md): Citrix Gateway 11.1, 12.0, and 12.1 allows Cache Poisoning. (no CVSS)
- [CVE-2020-10111](https://cve.now/CVE-2020-10111.md): Citrix Gateway 11.1, 12.0, and 12.1 has an Inconsistent Interpretation of HTTP Requests. (no CVSS)
- [CVE-2020-10110](https://cve.now/CVE-2020-10110.md): Citrix Gateway 11.1, 12.0, and 12.1 allows Information Exposure Through Caching. (no CVSS)
- [CVE-2020-5328](https://cve.now/CVE-2020-5328.md): Dell EMC Isilon OneFS versions prior to 8.2.0 contain an unauthorized access vulnerability due to a lack of thorough authorization checks wh (CVSS 9.8, Dell Isilon OneFS)
- [CVE-2020-5327](https://cve.now/CVE-2020-5327.md): Dell Security Management Server versions prior to 10.2.10 contain a Java RMI Deserialization of Untrusted Data vulnerability. (CVSS 8.1, Dell Encryption Enterprise)
- [CVE-2020-10193](https://cve.now/CVE-2020-10193.md): ESET Archive Support Module before 1294 allows virus-detection bypass via crafted RAR Compression Information in an archive. (no CVSS)
- [CVE-2020-7212](https://cve.now/CVE-2020-7212.md): The \_encode\_invalid\_chars function in util/url.py in the urllib3 library 1.25.2 through 1.25.7 for Python allows a denial of service (CPU co (no CVSS, urllib3)
- [CVE-2020-9458](https://cve.now/CVE-2020-9458.md): In the RegistrationMagic plugin through 4.6.0.3 for WordPress, the export function allows remote authenticated users (with minimal privilege (no CVSS)
- [CVE-2020-9457](https://cve.now/CVE-2020-9457.md): The RegistrationMagic plugin through 4.6.0.3 for WordPress allows remote authenticated users (with minimal privileges) to import custom vuln (no CVSS)
- [CVE-2020-9456](https://cve.now/CVE-2020-9456.md): In the RegistrationMagic plugin through 4.6.0.3 for WordPress, the user controller allows remote authenticated users (with minimal privilege (no CVSS)
- [CVE-2020-9455](https://cve.now/CVE-2020-9455.md): The RegistrationMagic plugin through 4.6.0.3 for WordPress allows remote authenticated users (with minimal privileges) to send arbitrary ema (no CVSS)
- [CVE-2020-9454](https://cve.now/CVE-2020-9454.md): A CSRF vulnerability in the RegistrationMagic plugin through 4.6.0.3 for WordPress allows remote attackers to forge requests on behalf of a (no CVSS)
- [CVE-2020-8113](https://cve.now/CVE-2020-8113.md): GitLab 10.7 and later through 12.7.2 has Incorrect Access Control. (no CVSS)
- [CVE-2020-9531](https://cve.now/CVE-2020-9531.md): An issue was discovered on Xiaomi MIUI V11.0.5.0.QFAEUXM devices. (no CVSS)
- [CVE-2020-9530](https://cve.now/CVE-2020-9530.md): An issue was discovered on Xiaomi MIUI V11.0.5.0.QFAEUXM devices. (no CVSS)
- [CVE-2020-10189](https://cve.now/CVE-2020-10189.md): Zoho ManageEngine Desktop Central before 10.0.474 allows remote code execution because of deserialization of untrusted data in getChartImage (CVSS 9.8, KEV)
- [CVE-2020-9756](https://cve.now/CVE-2020-9756.md): Patriot Viper RGB Driver 1.1 and prior exposes IOCTL and allows insufficient access control. (no CVSS)
- [CVE-2020-10188](https://cve.now/CVE-2020-10188.md): utility.c in telnetd in netkit telnet through 0.17 allows remote attackers to execute arbitrary code via short writes or urgent data, becaus (no CVSS)
- [CVE-2019-20503](https://cve.now/CVE-2019-20503.md): usrsctp before 2019-12-20 has out-of-bounds reads in sctp\_load\_addresses\_from\_init. (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2020-03-06
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.