# CVEs published 2020-03-09

68 CVEs were published on March 9, 2020: 2 critical, 6 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2020-10257](https://cve.now/CVE-2020-10257.md): The ThemeREX Addons plugin before 2020-03-09 for WordPress lacks access control on the /trx\_addons/v2/get/sc\_layout REST API endpoint, allow (CVSS 9.8)
- [CVE-2020-5342](https://cve.now/CVE-2020-5342.md): Dell Digital Delivery versions prior to 3.5.2015 contain an incorrect default permissions vulnerability. (CVSS 7.8, Dell Digital Delivery)
- [CVE-2020-10248](https://cve.now/CVE-2020-10248.md): BWA DiREX-Pro 1.2181 devices allow remote attackers to discover passwords via a direct request to val\_users.php3. (no CVSS)
- [CVE-2020-10249](https://cve.now/CVE-2020-10249.md): BWA DiREX-Pro 1.2181 devices allow full path disclosure via an invalid name array parameter to val\_soft.php3. (no CVSS)
- [CVE-2020-10250](https://cve.now/CVE-2020-10250.md): BWA DiREX-Pro 1.2181 devices allow remote attackers to execute arbitrary OS commands via shell metacharacters in the PKG parameter to uninst (no CVSS)
- [CVE-2020-10244](https://cve.now/CVE-2020-10244.md): JPaseto before 0.3.0 generates weak hashes when using v2.local tokens. (no CVSS)
- [CVE-2019-19614](https://cve.now/CVE-2019-19614.md): An issue was discovered in Halvotec RAQuest 10.23.10801.0. (no CVSS)
- [CVE-2020-10246](https://cve.now/CVE-2020-10246.md): MISP 2.4.122 has reflected XSS via unsanitized URL parameters. (no CVSS)
- [CVE-2020-10247](https://cve.now/CVE-2020-10247.md): MISP 2.4.122 has Persistent XSS in the sighting popover tool. (no CVSS)
- [CVE-2020-9758](https://cve.now/CVE-2020-9758.md): An issue was discovered in chat.php in LiveZilla Live Chat 8.0.1.3 (Helpdesk). (no CVSS)
- [CVE-2020-10190](https://cve.now/CVE-2020-10190.md): An issue was discovered in MunkiReport before 5.3.0. (no CVSS)
- [CVE-2020-10191](https://cve.now/CVE-2020-10191.md): An issue was discovered in MunkiReport before 5.3.0. (no CVSS)
- [CVE-2020-10192](https://cve.now/CVE-2020-10192.md): An issue was discovered in Munkireport before 5.3.0.3923. (no CVSS)
- [CVE-2011-3269](https://cve.now/CVE-2011-3269.md): Lexmark X, W, T, E, C, 6500e, and 25xxN devices before 2011-11-15 allow attackers to obtain sensitive information via a hidden email address (no CVSS)
- [CVE-2011-4538](https://cve.now/CVE-2011-4538.md): Lexmark X, W, T, E, and C devices before 2012-02-09 allow attackers to obtain sensitive information by reading passwords within exported set (no CVSS)
- [CVE-2016-1487](https://cve.now/CVE-2016-1487.md): Lexmark Markvision Enterprise before 2.3.0 misuses the Apache Commons Collections Library, leading to remote code execution because of Java (no CVSS)
- [CVE-2020-4084](https://cve.now/CVE-2020-4084.md): HCL Connections v5.5, v6.0, and v6.5 are vulnerable to cross-site scripting. (no CVSS, HCL Software HCL Connections)
- [CVE-2020-8987](https://cve.now/CVE-2020-8987.md): Avast AntiTrack before 1.5.1.172 and AVG Antitrack before 2.0.0.178 proxies traffic to HTTPS sites but does not validate certificates, and t (no CVSS)
- [CVE-2016-6918](https://cve.now/CVE-2016-6918.md): Lexmark Markvision Enterprise (MVE) before 2.4.1 allows remote attackers to execute arbitrary commands by uploading files. (CVSS 10.0)
- [CVE-2016-1159](https://cve.now/CVE-2016-1159.md): In ZOHO Password Manager Pro (PMP) 8.3.0 (Build 8303) and 8.4.0 (Build 8400,8401,8402), underprivileged users can obtain sensitive informati (no CVSS, ZOHO Password Manager Pro)
- [CVE-2014-1634](https://cve.now/CVE-2014-1634.md): SQL Injection exists in Advanced Newsletter Magento extension before 2.3.5 via the /store/advancednewsletter/index/subscribeajax/an\_category (no CVSS)
- [CVE-2015-7338](https://cve.now/CVE-2015-7338.md): SQL Injection exists in AcyMailing Joomla Component before 4.9.5 via exportgeolocorder in a geolocation\_longitude request to index.php. (no CVSS)
- [CVE-2015-7339](https://cve.now/CVE-2015-7339.md): JCE Joomla Component 2.5.0 to 2.5.2 allows arbitrary file upload via a .php file extension for an image file to the /com\_jce/editor/librarie (no CVSS)
- [CVE-2015-7340](https://cve.now/CVE-2015-7340.md): JEvents Joomla Component before 3.4.0 RC6 has SQL Injection via evid in a Manage Events action. (no CVSS)
- [CVE-2015-7341](https://cve.now/CVE-2015-7341.md): JNews Joomla Component before 8.5.0 allows arbitrary File Upload via Subscribers or Templates, as demonstrated by the .php5 extension. (no CVSS)
- [CVE-2015-7342](https://cve.now/CVE-2015-7342.md): JNews Joomla Component before 8.5.0 allows SQL injection via upload thumbnail, Queue Search Field, Subscribers Search Field, or Newsletters (no CVSS)
- [CVE-2019-10806](https://cve.now/CVE-2019-10806.md): vega-util prior to 1.13.1 allows manipulation of object prototype. (no CVSS, vega-util)
- [CVE-2020-9517](https://cve.now/CVE-2020-9517.md): There is an improper restriction of rendered UI layers or frames vulnerability in Micro Focus Service Manager Release Control versions 9.50 (no CVSS, Micro Focus International Service Manager)
- [CVE-2020-5256](https://cve.now/CVE-2020-5256.md): Remote Code Execution Through Image Uploads in BookStack (CVSS 7.9, BookStackApp BookStack · ssddanbrown/bookstack)
- [CVE-2020-1737](https://cve.now/CVE-2020-1737.md): A flaw was found in Ansible 2.7.17 and prior, 2.8.9 and prior, and 2.9.6 and prior when using the Extract-Zip function from the win\_unzip mo (CVSS 7.5, Red Hat Ansible · ansible)
- [CVE-2020-10235](https://cve.now/CVE-2020-10235.md): An issue was discovered in Froxlor before 0.10.14. (no CVSS, froxlor/froxlor)
- [CVE-2020-10237](https://cve.now/CVE-2020-10237.md): An issue was discovered in Froxlor through 0.10.15. (no CVSS, froxlor/froxlor)
- [CVE-2020-10236](https://cve.now/CVE-2020-10236.md): An issue was discovered in Froxlor before 0.10.14. (no CVSS, froxlor/froxlor)
- [CVE-2020-2158](https://cve.now/CVE-2020-2158.md): Jenkins Literate Plugin 1.0 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types, resulting in a r (no CVSS, Jenkins project Jenkins Literate Plugin · org.jenkins-ci.pl…)
- [CVE-2020-2159](https://cve.now/CVE-2020-2159.md): Jenkins CryptoMove Plugin 0.1.33 and earlier allows attackers with Job/Configure access to execute arbitrary OS commands on the Jenkins mast (no CVSS, Jenkins project Jenkins CryptoMove Plugin · io.jenkins.plug…)
- [CVE-2020-2155](https://cve.now/CVE-2020-2155.md): Jenkins OpenShift Deployer Plugin 1.2.0 and earlier transmits configured credentials in plain text as part of its global Jenkins configurati (no CVSS, Jenkins project Jenkins OpenShift Deployer Plugin · org.jen…)
- [CVE-2020-2156](https://cve.now/CVE-2020-2156.md): Jenkins DeployHub Plugin 8.0.14 and earlier transmits configured credentials in plain text as part of job configuration forms, potentially r (no CVSS, Jenkins project Jenkins DeployHub Plugin · com.openmake:dep…)
- [CVE-2020-2157](https://cve.now/CVE-2020-2157.md): Jenkins Skytap Cloud CI Plugin 2.07 and earlier transmits configured credentials in plain text as part of job configuration forms, potential (no CVSS, Jenkins project Jenkins Skytap Cloud CI Plugin · org.jenkin…)
- [CVE-2020-2153](https://cve.now/CVE-2020-2153.md): Jenkins Backlog Plugin 2.4 and earlier transmits configured credentials in plain text as part of job configuration forms, potentially result (no CVSS, Jenkins project Jenkins Backlog Plugin · org.jenkins-ci.plu…)
- [CVE-2020-2154](https://cve.now/CVE-2020-2154.md): Jenkins Zephyr for JIRA Test Management Plugin 1.5 and earlier stores its credentials in plain text in a global configuration file on the Je (no CVSS, Jenkins project Jenkins Zephyr for JIRA Test Management Plu…)
- [CVE-2020-2151](https://cve.now/CVE-2020-2151.md): Jenkins Quality Gates Plugin 2.5 and earlier transmits configured credentials in plain text as part of its global Jenkins configuration form (no CVSS, Jenkins project Jenkins Quality Gates Plugin · org.jenkins-…)
- [CVE-2020-2152](https://cve.now/CVE-2020-2152.md): Jenkins Subversion Release Manager Plugin 1.2 and earlier does not escape the error message for the Repository URL field form validation, re (no CVSS, Jenkins project Jenkins Subversion Release Manager Plugin ·…)
- [CVE-2020-2148](https://cve.now/CVE-2020-2148.md): A missing permission check in Jenkins Mac Plugin 1.1.0 and earlier allows attackers with Overall/Read permission to connect to an attacker-s (no CVSS, Jenkins project Jenkins Mac Plugin · fr.edf.jenkins.plugins…)
- [CVE-2020-2149](https://cve.now/CVE-2020-2149.md): Jenkins Repository Connector Plugin 1.2.6 and earlier transmits configured credentials in plain text as part of its global Jenkins configura (no CVSS, Jenkins project Jenkins Repository Connector Plugin · org.j…)
- [CVE-2020-2150](https://cve.now/CVE-2020-2150.md): Jenkins Sonar Quality Gates Plugin 1.3.1 and earlier transmits configured credentials in plain text as part of its global Jenkins configurat (no CVSS, Jenkins project Jenkins Sonar Quality Gates Plugin · org.je…)
- [CVE-2020-2146](https://cve.now/CVE-2020-2146.md): Jenkins Mac Plugin 1.1.0 and earlier does not validate SSH host keys when connecting agents created by the plugin, enabling man-in-the-middl (no CVSS, Jenkins project Jenkins Mac Plugin · fr.edf.jenkins.plugins…)
- [CVE-2020-2147](https://cve.now/CVE-2020-2147.md): A cross-site request forgery vulnerability in Jenkins Mac Plugin 1.1.0 and earlier allows attackers to connect to an attacker-specified SSH (no CVSS, Jenkins project Jenkins Mac Plugin · fr.edf.jenkins.plugins…)
- [CVE-2020-2144](https://cve.now/CVE-2020-2144.md): Jenkins Rundeck Plugin 3.6.6 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. (no CVSS, Jenkins project Jenkins Rundeck Plugin · org.jenkins-ci.plu…)
- [CVE-2020-2145](https://cve.now/CVE-2020-2145.md): Jenkins Zephyr Enterprise Test Management Plugin 1.9.1 and earlier stores its Zephyr password in plain text on the Jenkins master file syste (no CVSS, Jenkins project Jenkins Zephyr Enterprise Test Management P…)
- [CVE-2020-2141](https://cve.now/CVE-2020-2141.md): A cross-site request forgery vulnerability in Jenkins P4 Plugin 1.10.10 and earlier allows attackers to trigger builds or add a labels in Pe (no CVSS, Jenkins project Jenkins P4 Plugin · org.jenkins-ci.plugins:…)
- [CVE-2020-2142](https://cve.now/CVE-2020-2142.md): A missing permission check in Jenkins P4 Plugin 1.10.10 and earlier allows attackers with Overall/Read permission to trigger builds. (no CVSS, Jenkins project Jenkins P4 Plugin · org.jenkins-ci.plugins:…)
- [CVE-2020-2143](https://cve.now/CVE-2020-2143.md): Jenkins Logstash Plugin 2.3.1 and earlier transmits configured credentials in plain text as part of its global Jenkins configuration form, p (no CVSS, Jenkins project Jenkins Logstash Plugin · org.jenkins-ci.pl…)
- [CVE-2020-2139](https://cve.now/CVE-2020-2139.md): An arbitrary file write vulnerability in Jenkins Cobertura Plugin 1.15 and earlier allows attackers able to control the coverage report file (no CVSS, Jenkins project Jenkins Cobertura Plugin · org.jenkins-ci.p…)
- [CVE-2020-2140](https://cve.now/CVE-2020-2140.md): Jenkins Audit Trail Plugin 3.2 and earlier does not escape the error message for the URL Patterns field form validation, resulting in a refl (no CVSS, Jenkins project Jenkins Audit Trail Plugin · org.jenkins-ci…)
- [CVE-2020-2136](https://cve.now/CVE-2020-2136.md): Jenkins Git Plugin 4.2.0 and earlier does not escape the error message for the repository URL for Microsoft TFS field form validation, resul (no CVSS, Jenkins project Jenkins Git Plugin · org.jenkins-ci.plugins…)
- [CVE-2020-2137](https://cve.now/CVE-2020-2137.md): Jenkins Timestamper Plugin 1.11.1 and earlier does not sanitize HTML formatting of its output, resulting in a stored XSS vulnerability explo (no CVSS, Jenkins project Jenkins Timestamper Plugin · org.jenkins-ci…)
- [CVE-2020-2138](https://cve.now/CVE-2020-2138.md): Jenkins Cobertura Plugin 1.15 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. (no CVSS, Jenkins project Jenkins Cobertura Plugin · org.jenkins-ci.p…)
- [CVE-2020-2134](https://cve.now/CVE-2020-2134.md): Sandbox protection in Jenkins Script Security Plugin 1.70 and earlier could be circumvented through crafted constructor calls and crafted co (no CVSS, Jenkins project Jenkins Script Security Plugin · org.jenkin…)
- [CVE-2020-2135](https://cve.now/CVE-2020-2135.md): Sandbox protection in Jenkins Script Security Plugin 1.70 and earlier could be circumvented through crafted method calls on objects that imp (no CVSS, Jenkins project Jenkins Script Security Plugin · org.jenkin…)
- [CVE-2020-4217](https://cve.now/CVE-2020-4217.md): The IBM Spectrum Scale 4.2 and 5.0 file system component is affected by a denial of service security vulnerability. (CVSS 7.5, IBM Spectrum Scale)
- [CVE-2020-9386](https://cve.now/CVE-2020-9386.md): In Mahara 18.10 before 18.10.5, 19.04 before 19.04.4, and 19.10 before 19.10.2, file metadata information is disclosed to group members in t (no CVSS)
- [CVE-2020-9282](https://cve.now/CVE-2020-9282.md): In Mahara 18.10 before 18.10.5, 19.04 before 19.04.4, and 19.10 before 19.10.2, certain personal information is discoverable inspecting netw (no CVSS)
- [CVE-2015-7343](https://cve.now/CVE-2015-7343.md): JNews Joomla Component before 8.5.0 has XSS via the mailingsearch parameter. (no CVSS)
- [CVE-2015-7344](https://cve.now/CVE-2015-7344.md): HikaShop Joomla Component before 2.6.0 has XSS via an injected payload\[/caption\]. (no CVSS)
- [CVE-2015-7968](https://cve.now/CVE-2015-7968.md): nwbc\_ext2int in SAP NetWeaver Application Server before Security Note 2183189 allows XXE attacks for local file inclusion via the sap/bc/ui2 (CVSS 6.4)
- [CVE-2019-20504](https://cve.now/CVE-2019-20504.md): service/krashrpt.php in Quest KACE K1000 Systems Management Appliance before 6.4 SP3 (6.4.120822) allows a remote attacker to execute code v (no CVSS)
- [CVE-2016-11021](https://cve.now/CVE-2016-11021.md): setSystemCommand on D-Link DCS-930L devices before 2.12 allows a remote attacker to execute code via an OS command in the SystemCommand para (CVSS 7.2, KEV)
- [CVE-2020-1706](https://cve.now/CVE-2020-1706.md): It has been found that in openshift-enterprise version 3.11 and openshift-enterprise versions 4.1 up to, including 4.3, multiple containers (CVSS 7.0, Red Hat openshift/apb-tools-container)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2020-03-09
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.