CVEs published March 9, 2020
68 CVEs were published on March 9, 2020: 2 critical, 6 high. 1 is now in CISA KEV.
- Published
- 68
- Critical
- 2
- High
- 6
- Medium
- 1
- Low
- 0
- Unrated
- 59
- Now in CISA KEV
- 1
- Fix available
- 23
Most affected products
- froxlor/froxlor
- 3
- Jenkins project Jenkins Mac Plugin · fr.edf.jenkins.plugins…
- 3
- Jenkins project Jenkins Cobertura Plugin · org.jenkins-ci.p…
- 2
- Jenkins project Jenkins P4 Plugin · org.jenkins-ci.plugins:…
- 2
- Jenkins project Jenkins Script Security Plugin · org.jenkin…
- 2
- BookStackApp BookStack · ssddanbrown/bookstack
- 1
- Dell Digital Delivery
- 1
- HCL Software HCL Connections
- 1
- IBM Spectrum Scale
- 1
- Jenkins project Jenkins Audit Trail Plugin · org.jenkins-ci…
- 1
Critical 2
High 6
- CVE-2020-5342Dell Digital Delivery versions prior to 3.5.2015 contain an incorrect default permissions vulnerability.Dell Digital Delivery
- CVE-2020-5256Remote Code Execution Through Image Uploads in BookStackBookStackApp BookStack · ssddanbrown/bookstack
- CVE-2020-1737A flaw was found in Ansible 2.7.17 and prior, 2.8.9 and prior, and 2.9.6 and prior when using the Extract-Zip function from the win_unzip moRed Hat Ansible · ansible
- CVE-2020-4217The IBM Spectrum Scale 4.2 and 5.0 file system component is affected by a denial of service security vulnerability.IBM Spectrum Scale
- CVE-2016-11021setSystemCommand on D-Link DCS-930L devices before 2.12 allows a remote attacker to execute code via an OS command in the SystemCommand para
- CVE-2020-1706It has been found that in openshift-enterprise version 3.11 and openshift-enterprise versions 4.1 up to, including 4.3, multiple containers Red Hat openshift/apb-tools-container
Medium, low and unrated 60
- CVE-2020-10248BWA DiREX-Pro 1.2181 devices allow remote attackers to discover passwords via a direct request to val_users.php3.
- CVE-2020-10249BWA DiREX-Pro 1.2181 devices allow full path disclosure via an invalid name array parameter to val_soft.php3.
- CVE-2020-10250BWA DiREX-Pro 1.2181 devices allow remote attackers to execute arbitrary OS commands via shell metacharacters in the PKG parameter to uninst
- CVE-2020-10244JPaseto before 0.3.0 generates weak hashes when using v2.local tokens.
- CVE-2019-19614An issue was discovered in Halvotec RAQuest 10.23.10801.0.
- CVE-2020-10246MISP 2.4.122 has reflected XSS via unsanitized URL parameters.
- CVE-2020-10247MISP 2.4.122 has Persistent XSS in the sighting popover tool.
- CVE-2020-9758An issue was discovered in chat.php in LiveZilla Live Chat 8.0.1.3 (Helpdesk).
- CVE-2020-10190An issue was discovered in MunkiReport before 5.3.0.
- CVE-2020-10191An issue was discovered in MunkiReport before 5.3.0.
- CVE-2020-10192An issue was discovered in Munkireport before 5.3.0.3923.
- CVE-2011-3269Lexmark X, W, T, E, C, 6500e, and 25xxN devices before 2011-11-15 allow attackers to obtain sensitive information via a hidden email address
- CVE-2011-4538Lexmark X, W, T, E, and C devices before 2012-02-09 allow attackers to obtain sensitive information by reading passwords within exported set
- CVE-2016-1487Lexmark Markvision Enterprise before 2.3.0 misuses the Apache Commons Collections Library, leading to remote code execution because of Java
- CVE-2020-4084HCL Connections v5.5, v6.0, and v6.5 are vulnerable to cross-site scripting.HCL Software HCL Connections
- CVE-2020-8987Avast AntiTrack before 1.5.1.172 and AVG Antitrack before 2.0.0.178 proxies traffic to HTTPS sites but does not validate certificates, and t
- CVE-2016-1159In ZOHO Password Manager Pro (PMP) 8.3.0 (Build 8303) and 8.4.0 (Build 8400,8401,8402), underprivileged users can obtain sensitive informatiZOHO Password Manager Pro
- CVE-2014-1634SQL Injection exists in Advanced Newsletter Magento extension before 2.3.5 via the /store/advancednewsletter/index/subscribeajax/an_category
- CVE-2015-7338SQL Injection exists in AcyMailing Joomla Component before 4.9.5 via exportgeolocorder in a geolocation_longitude request to index.php.
- CVE-2015-7339JCE Joomla Component 2.5.0 to 2.5.2 allows arbitrary file upload via a .php file extension for an image file to the /com_jce/editor/librarie
- CVE-2015-7340JEvents Joomla Component before 3.4.0 RC6 has SQL Injection via evid in a Manage Events action.
- CVE-2015-7341JNews Joomla Component before 8.5.0 allows arbitrary File Upload via Subscribers or Templates, as demonstrated by the .php5 extension.
- CVE-2015-7342JNews Joomla Component before 8.5.0 allows SQL injection via upload thumbnail, Queue Search Field, Subscribers Search Field, or Newsletters
- CVE-2019-10806vega-util prior to 1.13.1 allows manipulation of object prototype.vega-util
- CVE-2020-9517There is an improper restriction of rendered UI layers or frames vulnerability in Micro Focus Service Manager Release Control versions 9.50 Micro Focus International Service Manager
- CVE-2020-10235An issue was discovered in Froxlor before 0.10.14.froxlor/froxlor
- CVE-2020-10237An issue was discovered in Froxlor through 0.10.15.froxlor/froxlor
- CVE-2020-10236An issue was discovered in Froxlor before 0.10.14.froxlor/froxlor
- CVE-2020-2158Jenkins Literate Plugin 1.0 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types, resulting in a rJenkins project Jenkins Literate Plugin · org.jenkins-ci.pl…
- CVE-2020-2159Jenkins CryptoMove Plugin 0.1.33 and earlier allows attackers with Job/Configure access to execute arbitrary OS commands on the Jenkins mastJenkins project Jenkins CryptoMove Plugin · io.jenkins.plug…
- CVE-2020-2155Jenkins OpenShift Deployer Plugin 1.2.0 and earlier transmits configured credentials in plain text as part of its global Jenkins configuratiJenkins project Jenkins OpenShift Deployer Plugin · org.jen…
- CVE-2020-2156Jenkins DeployHub Plugin 8.0.14 and earlier transmits configured credentials in plain text as part of job configuration forms, potentially rJenkins project Jenkins DeployHub Plugin · com.openmake:dep…
- CVE-2020-2157Jenkins Skytap Cloud CI Plugin 2.07 and earlier transmits configured credentials in plain text as part of job configuration forms, potentialJenkins project Jenkins Skytap Cloud CI Plugin · org.jenkin…
- CVE-2020-2153Jenkins Backlog Plugin 2.4 and earlier transmits configured credentials in plain text as part of job configuration forms, potentially resultJenkins project Jenkins Backlog Plugin · org.jenkins-ci.plu…
- CVE-2020-2154Jenkins Zephyr for JIRA Test Management Plugin 1.5 and earlier stores its credentials in plain text in a global configuration file on the JeJenkins project Jenkins Zephyr for JIRA Test Management Plu…
- CVE-2020-2151Jenkins Quality Gates Plugin 2.5 and earlier transmits configured credentials in plain text as part of its global Jenkins configuration formJenkins project Jenkins Quality Gates Plugin · org.jenkins-…
- CVE-2020-2152Jenkins Subversion Release Manager Plugin 1.2 and earlier does not escape the error message for the Repository URL field form validation, reJenkins project Jenkins Subversion Release Manager Plugin ·…
- CVE-2020-2148A missing permission check in Jenkins Mac Plugin 1.1.0 and earlier allows attackers with Overall/Read permission to connect to an attacker-sJenkins project Jenkins Mac Plugin · fr.edf.jenkins.plugins…
- CVE-2020-2149Jenkins Repository Connector Plugin 1.2.6 and earlier transmits configured credentials in plain text as part of its global Jenkins configuraJenkins project Jenkins Repository Connector Plugin · org.j…
- CVE-2020-2150Jenkins Sonar Quality Gates Plugin 1.3.1 and earlier transmits configured credentials in plain text as part of its global Jenkins configuratJenkins project Jenkins Sonar Quality Gates Plugin · org.je…
- CVE-2020-2146Jenkins Mac Plugin 1.1.0 and earlier does not validate SSH host keys when connecting agents created by the plugin, enabling man-in-the-middlJenkins project Jenkins Mac Plugin · fr.edf.jenkins.plugins…
- CVE-2020-2147A cross-site request forgery vulnerability in Jenkins Mac Plugin 1.1.0 and earlier allows attackers to connect to an attacker-specified SSH Jenkins project Jenkins Mac Plugin · fr.edf.jenkins.plugins…
- CVE-2020-2144Jenkins Rundeck Plugin 3.6.6 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.Jenkins project Jenkins Rundeck Plugin · org.jenkins-ci.plu…
- CVE-2020-2145Jenkins Zephyr Enterprise Test Management Plugin 1.9.1 and earlier stores its Zephyr password in plain text on the Jenkins master file systeJenkins project Jenkins Zephyr Enterprise Test Management P…
- CVE-2020-2141A cross-site request forgery vulnerability in Jenkins P4 Plugin 1.10.10 and earlier allows attackers to trigger builds or add a labels in PeJenkins project Jenkins P4 Plugin · org.jenkins-ci.plugins:…
- CVE-2020-2142A missing permission check in Jenkins P4 Plugin 1.10.10 and earlier allows attackers with Overall/Read permission to trigger builds.Jenkins project Jenkins P4 Plugin · org.jenkins-ci.plugins:…
- CVE-2020-2143Jenkins Logstash Plugin 2.3.1 and earlier transmits configured credentials in plain text as part of its global Jenkins configuration form, pJenkins project Jenkins Logstash Plugin · org.jenkins-ci.pl…
- CVE-2020-2139An arbitrary file write vulnerability in Jenkins Cobertura Plugin 1.15 and earlier allows attackers able to control the coverage report fileJenkins project Jenkins Cobertura Plugin · org.jenkins-ci.p…
- CVE-2020-2140Jenkins Audit Trail Plugin 3.2 and earlier does not escape the error message for the URL Patterns field form validation, resulting in a reflJenkins project Jenkins Audit Trail Plugin · org.jenkins-ci…
- CVE-2020-2136Jenkins Git Plugin 4.2.0 and earlier does not escape the error message for the repository URL for Microsoft TFS field form validation, resulJenkins project Jenkins Git Plugin · org.jenkins-ci.plugins…
- CVE-2020-2137Jenkins Timestamper Plugin 1.11.1 and earlier does not sanitize HTML formatting of its output, resulting in a stored XSS vulnerability exploJenkins project Jenkins Timestamper Plugin · org.jenkins-ci…
- CVE-2020-2138Jenkins Cobertura Plugin 1.15 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.Jenkins project Jenkins Cobertura Plugin · org.jenkins-ci.p…
- CVE-2020-2134Sandbox protection in Jenkins Script Security Plugin 1.70 and earlier could be circumvented through crafted constructor calls and crafted coJenkins project Jenkins Script Security Plugin · org.jenkin…
- CVE-2020-2135Sandbox protection in Jenkins Script Security Plugin 1.70 and earlier could be circumvented through crafted method calls on objects that impJenkins project Jenkins Script Security Plugin · org.jenkin…
- CVE-2020-9386In Mahara 18.10 before 18.10.5, 19.04 before 19.04.4, and 19.10 before 19.10.2, file metadata information is disclosed to group members in t
- CVE-2020-9282In Mahara 18.10 before 18.10.5, 19.04 before 19.04.4, and 19.10 before 19.10.2, certain personal information is discoverable inspecting netw
- CVE-2015-7343JNews Joomla Component before 8.5.0 has XSS via the mailingsearch parameter.
- CVE-2015-7344HikaShop Joomla Component before 2.6.0 has XSS via an injected payload[/caption].
- CVE-2015-7968nwbc_ext2int in SAP NetWeaver Application Server before Security Note 2183189 allows XXE attacks for local file inclusion via the sap/bc/ui2
- CVE-2019-20504service/krashrpt.php in Quest KACE K1000 Systems Management Appliance before 6.4 SP3 (6.4.120822) allows a remote attacker to execute code v