CVEs published March 10, 2020
143 CVEs were published on March 10, 2020: 4 critical, 14 high. 3 are now in CISA KEV.
- Published
- 143
- Critical
- 4
- High
- 14
- Medium
- 18
- Low
- 3
- Unrated
- 104
- Now in CISA KEV
- 3
- Fix available
- 22
Most affected products
- Android
- 42
- WAGO PFC200 Firmware
- 8
- Siemens Control Center Server
- 5
- Siemens SiNVR/SiVMS Video Server
- 4
- WAGO PFC200 Firmware · WAGO PFC100 Firmware
- 3
- Facebook Thrift
- 2
- NetHack
- 2
- SAP SE SAP Commerce Cloud
- 2
- SAP SE SAP Enable Now
- 2
- SAP SE SAP Solution Manager
- 2
Critical 4
- CVE-2020-6207SAP Solution Manager (User Experience Monitoring), version- 7.2, due to Missing Authentication Check does not perform any authentication forSAP SE SAP Solution Manager
- CVE-2020-6203SAP NetWeaver UDDI Server (Services Registry), versions- 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50; allows an attacker to exploit insufficienSAP SE SAP NetWeaver UDDI Server
- CVE-2020-6198SAP Solution Manager (Diagnostics Agent), version 720, allows unencrypted connections from unauthenticated sources.SAP SE SAP Solution Manager
- CVE-2019-7589Kantech EntraPass Improper Input ValidationJohnson Controls Kantech EntraPass Corporate Edition · John…
High 14
- CVE-2020-6209SAP Disclosure Management, version 10.1, does not perform necessary authorization checks for an authenticated user, allowing access to adminSAP SE SAP Disclosure Management
- CVE-2020-6208SAP Business Objects Business Intelligence Platform (Crystal Reports), versions- 4.1, 4.2, allows an attacker with basic authorization to inSAP SE SAP Business Objects Business Intelligence Platform
- CVE-2020-6196SAP BusinessObjects Mobile (MobileBIService), version 4.2, allows an attacker to generate multiple requests, using which he can block all thSAP SE SAP BusinessObjects Mobile
- CVE-2020-0069In the ioctl handlers of the Mediatek Command Queue driver, there is a possible out of bounds write due to insufficient input sanitization aAndroid
- CVE-2020-0041In binder_transaction of binder.c, there is a possible out of bounds write due to an incorrect bounds check.Android
- CVE-2020-9044Metasys Improper Restriction of XML External Entity ReferenceJohnson Controls Metasys Application and Data Server · J… +8
- CVE-2019-18336A vulnerability has been identified in SIMATIC S7-300 CPU family (incl.Siemens AG SIMATIC S7-300 CPU family · Siemens AG SIMATI… +2
- CVE-2019-19282A vulnerability has been identified in OpenPCS 7 V8.1 (All versions), OpenPCS 7 V8.2 (All versions), OpenPCS 7 V9.0 (All versions < V9.0 UpdSiemens OpenPCS 7 · Siemens SIMATIC BATCH +5
- CVE-2019-19292A vulnerability has been identified in Control Center Server (CCS) (All versions < V1.5.0).Siemens Control Center Server
- CVE-2019-19297A vulnerability has been identified in SiNVR/SiVMS Video Server (All versions < V5.0.0).Siemens SiNVR/SiVMS Video Server
- CVE-2019-19298A vulnerability has been identified in SiNVR/SiVMS Video Server (All versions < V5.0.0), SiNVR/SiVMS Video Server (All versions >= V5.0.0 < Siemens SiNVR/SiVMS Video Server
- CVE-2019-19299A vulnerability has been identified in SiNVR/SiVMS Video Server (All versions < V5.0.0), SiNVR/SiVMS Video Server (All versions >= V5.0.0 < Siemens SiNVR/SiVMS Video Server
- CVE-2020-5258Prototype pollution in dojodojo
- CVE-2020-5259Prototype Pollution in Dojoxdojox
Medium, low and unrated 125
- CVE-2019-5106A hard-coded encryption key vulnerability exists in the authentication functionality of WAGO e!Cockpit version 1.5.1.1.WAGO e!Cockpit
- CVE-2019-5107A cleartext transmission vulnerability exists in the network communication functionality of WAGO e!Cockpit version 1.5.1.1.WAGO e!Cockpit
- CVE-2019-5134An exploitable regular expression without anchors vulnerability exists in the Web-Based Management (WBM) authentication functionality of WAGWAGO PFC200 Firmware · WAGO PFC100 Firmware
- CVE-2019-5161An exploitable remote code execution vulnerability exists in the Cloud Connectivity functionality of WAGO PFC200 versions 03.02.02(14), 03.0WAGO PFC200 Firmware
- CVE-2019-10807Blamer versions prior to 1.0.1 allows execution of arbitrary commands.blamer
- CVE-2019-5156An exploitable command injection vulnerability exists in the cloud connectivity functionality of WAGO PFC200 versions 03.02.02(14), 03.01.07WAGO PFC200 Firmware
- CVE-2019-5157An exploitable command injection vulnerability exists in the Cloud Connectivity functionality of WAGO PFC200 Firmware versions 03.02.02(14),WAGO PFC200 Firmware
- CVE-2019-5158An exploitable firmware downgrade vulnerability exists in the firmware update package functionality of the WAGO e!COCKPIT automation softwarWAGO e!COCKPIT
- CVE-2019-5159An exploitable improper input validation vulnerability exists in the firmware update functionality of WAGO e!COCKPIT automation software v1.WAGO e!COCKPIT
- CVE-2019-5160An exploitable improper host validation vulnerability exists in the Cloud Connectivity functionality of WAGO PFC200 Firmware versions 03.02.WAGO PFC200 Firmware
- CVE-2019-5168An exploitable command injection vulnerability exists in the iocheckd service ‘I/O-Check’ function of the WAGO PFC 200 version 03.02.02(14).WAGO PFC200 Firmware
- CVE-2019-5167An exploitable command injection vulnerability exists in the iocheckd service ‘I/O-Check’ function of the WAGO PFC 200 version 03.02.02(14).WAGO PFC200 Firmware
- CVE-2019-5166An exploitable stack buffer overflow vulnerability exists in the iocheckd service ‘I/O-Check’ functionality of WAGO PFC 200 version 03.02.02WAGO PFC200 Firmware
- CVE-2019-5135An exploitable timing discrepancy vulnerability exists in the authentication functionality of the Web-Based Management (WBM) web applicationWAGO PFC200 Firmware · WAGO PFC100 Firmware
- CVE-2019-5149The WBM web application on firmwares prior to 03.02.02 and 03.01.07 on the WAGO PFC100 and PFC2000, respectively, runs on a lighttpd web serWAGO PFC200 Firmware · WAGO PFC100 Firmware
- CVE-2019-5155An exploitable command injection vulnerability exists in the cloud connectivity feature of WAGO PFC200.WAGO PFC200 Firmware
- CVE-2019-3553C++ Facebook Thrift servers would not error upon receiving messages declaring containers of sizes larger than the payload.Facebook Thrift
- CVE-2019-11938Java Facebook Thrift servers would not error upon receiving messages declaring containers of sizes larger than the payload.Facebook Thrift
- CVE-2020-10372Ramp AltitudeCDN Altimeter before 2.4.0 allows authenticated Stored XSS via the vdms/ipmapping.jsp location field to the dms/rest/services/d
- CVE-2020-6210SAP Fiori Launchpad, versions- 753, 754, does not sufficiently encode user-controlled inputs, and hence allowing the attacker to inject the SAP SE SAP Fiori Launchpad
- CVE-2020-6206SAP Cloud Platform Integration for Data Services, version 1.0, allows user inputs to be reflected as error or warning massages.SAP SE SAP Cloud Platform Integration for Data Services
- CVE-2020-6205SAP NetWeaver AS ABAP Business Server Pages (Smart Forms), SAP_BASIS versions- 7.00, 7.01, 7.02, 7.10, 7.11, 7.30, 7.31, 7.40, 7.50, 7.51, 7SAP SE SAP NetWeaver Application Server ABAP (Smart Forms)…
- CVE-2020-6204The selection query in SAP Treasury and Risk Management (Transaction Management) (EA-FINSERV?versions 600, 603, 604, 605, 606, 616, 617, 618SAP SE SAP Treasury and Risk Management (Transaction Manage…
- CVE-2020-6202SAP NetWeaver Application Server Java (User Management Engine), versions- 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50; does not sufficiently vaSAP SE SAP NetWeaver Application Server Java
- CVE-2020-6201The SAP Commerce (Testweb Extension), versions- 6.6, 6.7, 1808, 1811, 1905, does not sufficiently encode user-controlled inputs, due to whicSAP SE SAP Commerce Cloud
- CVE-2020-6200The SAP Commerce (SmartEdit Extension), versions- 6.6, 6.7, 1808, 1811, is vulnerable to client-side angularjs template injection, a variantSAP SE SAP Commerce Cloud
- CVE-2020-6199The view FIMENAV_COMPCERT in SAP ERP (MENA Certificate Management), EAPPGLO version 607, SAP_FIN versions- 618, 730 and SAP S/4HANA (MENA CeSAP SE SAP ERP · SAP SE SAP S/4HANA
- CVE-2020-6197SAP Enable Now, before version 1908, does not invalidate session tokens in a timely manner.SAP SE SAP Enable Now
- CVE-2020-6178SAP Enable Now, before version 1911, sends the Session ID cookie value in URL.SAP SE SAP Enable Now
- CVE-2020-0057In btm_process_inq_results of btm_inq.cc, there is a possible out of bounds read due to a missing bounds check.Android
- CVE-2020-0056In btu_hcif_connection_comp_evt of btu_hcif.cc, there is a possible out of bounds read due to a missing bounds check.Android
- CVE-2020-0055In l2c_link_process_num_completed_pkts of l2c_link.cc, there is a possible out of bounds read due to a missing bounds check.Android
- CVE-2020-0054In WifiNetworkSuggestionsManager of WifiNetworkSuggestionsManager.java, there is a possible permission revocation due to a missing permissioAndroid
- CVE-2020-0053In convertHidlNanDataPathInitiatorRequestToLegacy, and convertHidlNanDataPathIndicationResponseToLegacy of hidl_struct_util.cpp, there is a Android
- CVE-2020-0052In smsSelected of AnswerFragment.java, there is a way to send an SMS from the lock screen due to a permissions bypass.Android
- CVE-2020-0085In setBluetoothTethering of PanService.java, there is a possible permission bypass due to a missing permission check.Android
- CVE-2020-0051In onCreate of SettingsHomepageActivity, there is a possible tapjacking attack.Android
- CVE-2020-0050In nfa_hciu_send_msg of nfa_hci_utils.cc, there is a possible out of bounds write due to improper input validation.Android
- CVE-2020-0049In onReadBuffer() of StreamingSource.cpp, there is a possible information disclosure due to uninitialized data.Android
- CVE-2020-0048In onTransact of IAudioFlinger.cpp, there is a possible stack information leak due to uninitialized data.Android
- CVE-2020-0047In setMasterMute of AudioService.java, there is a missing permission check.Android
- CVE-2020-0046In DrmPlugin::releaseSecureStops of DrmPlugin.cpp, there is a possible out of bounds write due to a heap buffer overflow.Android
- CVE-2020-0087In getProcessPss of ActivityManagerService.java, there is a possible side channel information disclosure.Android
- CVE-2020-0084In several functions of NotificationManagerService.java, there are missing permission checks.Android
- CVE-2020-0062In Euicc, there is a possible information disclosure due to an included test Certificate.Android
- CVE-2020-0066In the netlink driver, there is a possible out of bounds write due to a race condition.Android
- CVE-2020-0063In SurfaceFlinger, it is possible to override UI confirmation screen protected by the TEE.Android
- CVE-2020-0045In StatsService::command of StatsService.cpp, there is possible memory corruption due to a race condition.Android
- CVE-2020-0061In Pixel Recorder, there is a possible permissions bypass allowing arbitrary apps to record audio.Android
- CVE-2020-0083In setRequirePmfInternal of sta_network.cpp, there is a possible default value being improperly applied due to a logic error.Android
- CVE-2020-0060In query of SmsProvider.java and MmsSmsProvider.java, there is a possible permission bypass due to SQL injection.Android
- CVE-2020-0059In btm_ble_batchscan_filter_track_adv_vse_cback of btm_ble_batchscan.cc, there is a possible out of bounds read due to a missing bounds checAndroid
- CVE-2020-0058In l2c_rcv_acl_data of l2c_main.cc, there is a possible out of bounds read due to an incorrect bounds check.Android
- CVE-2020-0044In set_nonce of fpc_ta_qc_auth.c, there is a possible out of bounds read due to a missing bounds check.Android
- CVE-2020-0043In authorize_enrol of fpc_ta_hw_auth.c, there is a possible out of bounds read due to a missing bounds check.Android
- CVE-2020-0042In fpc_ta_hw_auth_unwrap_key of fpc_ta_hw_auth_qsee.c, there is a possible out of bounds read due to a missing bounds check.Android
- CVE-2020-0039In rw_i93_sm_update_ndef of rw_i93.cc, there is a possible read of uninitialized data due to a missing bounds check.Android
- CVE-2020-0038In rw_i93_sm_update_ndef of rw_i93.cc, there is a possible read of uninitialized data due to a missing bounds check.Android
- CVE-2020-0037In rw_i93_sm_set_read_only of rw_i93.cc, there is a possible out of bounds read due to a missing bounds check.Android
- CVE-2020-0036In hasPermissions of PermissionMonitor.java, there is a possible access to restricted permissions due to a permissions bypass.Android
- CVE-2020-0035In query of TelephonyProvider.java, there is a possible access to SIM card info due to a missing permission check.Android
- CVE-2020-0034In vp8_decode_frame of decodeframe.c, there is a possible out of bounds read due to improper input validation.Android
- CVE-2020-0033In CryptoPlugin::decrypt of CryptoPlugin.cpp, there is a possible out of bounds write due to stale pointer.Android
- CVE-2020-0032In ih264d_release_display_bufs of ih264d_utils.c, there is a possible out of bounds write due to a heap buffer overflow.Android
- CVE-2020-0031In triggerAugmentedAutofillLocked and related functions of Session.java, it is possible for Augmented Autofill to display sensitive informatAndroid
- CVE-2020-0029In the WifiConfigManager, there is a possible storage of location history which can only be deleted by triggering a factory reset.Android
- CVE-2020-0012In fpc_ta_pn_get_unencrypted_image of fpc_ta_pn.c, there is a possible out of bounds write due to a missing bounds check.Android
- CVE-2020-0011In get_auth_result of fpc_ta_hw_auth.c, there is a possible out of bounds write due to a missing bounds check.Android
- CVE-2020-0010In fpc_ta_get_build_info of fpc_ta_kpi.c, there is a possible out of bounds write due to a missing bounds check.Android
- CVE-2019-19277A vulnerability has been identified in SIPORT MP (All versions < 3.1.4).Siemens AG SIPORT MP
- CVE-2019-19279A vulnerability has been identified in SIPROTEC 4 and SIPROTEC Compact relays equipped with EN100 Ethernet communication modules (All versioSiemens AG SIPROTEC 4 and SIPROTEC Compact relays equipped…
- CVE-2019-19281A vulnerability has been identified in SIMATIC ET 200SP Open Controller CPU 1515SP PC2 (incl.Siemens AG SIMATIC ET 200SP Open Controller CPU 1515SP P… +1
- CVE-2019-19290A vulnerability has been identified in Control Center Server (CCS) (All versions < V1.5.0).Siemens Control Center Server
- CVE-2019-19291A vulnerability has been identified in Control Center Server (CCS) (All versions < V1.5.0), SiNVR/SiVMS Video Server (All versions < V5.0.0)Siemens Control Center Server · Siemens SiNVR/SiVMS Video S…
- CVE-2019-19293A vulnerability has been identified in Control Center Server (CCS) (All versions < V1.5.0).Siemens Control Center Server
- CVE-2019-19294A vulnerability has been identified in Control Center Server (CCS) (All versions < V1.5.0).Siemens Control Center Server
- CVE-2019-19295A vulnerability has been identified in Control Center Server (CCS) (All versions < V1.5.0).Siemens Control Center Server
- CVE-2019-19296A vulnerability has been identified in SiNVR/SiVMS Video Server (All versions < V5.0.0).Siemens SiNVR/SiVMS Video Server
- CVE-2019-6585A vulnerability has been identified in SCALANCE S602 (All versions >= V3.0 and < V4.1), SCALANCE S612 (All versions >= V3.0 and < V4.1), SCASiemens SCALANCE S602 · Siemens SCALANCE S612 +2
- CVE-2020-7579A vulnerability has been identified in Spectrum Power™ 5 (All versions < v5.50 HF02).Siemens AG Spectrum Power™
- CVE-2019-15034hw/display/bochs-display.c in QEMU 4.0.0 does not ensure a sufficient PCI config space allocation, leading to a buffer overflow involving th
- CVE-2019-13457An issue was discovered in Open Ticket Request System (OTRS) 7.0.x through 7.0.8.
- CVE-2019-13121An issue was discovered in GitLab Enterprise Edition 10.6 through 12.0.2.
- CVE-2019-13011An issue was discovered in GitLab Enterprise Edition 8.11.0 through 12.0.2.
- CVE-2019-13010An issue was discovered in GitLab Enterprise Edition 8.3 through 12.0.2.
- CVE-2019-13009An issue was discovered in GitLab Community and Enterprise Edition 9.2 through 12.0.2.
- CVE-2019-13007An issue was discovered in GitLab Community and Enterprise Edition 11.11 through 12.0.2.
- CVE-2019-13006An issue was discovered in GitLab Community and Enterprise Edition 9.0 and through 12.0.2.
- CVE-2020-9440A cross-site scripting (XSS) vulnerability in the WSC plugin through 5.5.7.5 for CKEditor 4 allows remote attackers to run arbitrary web scr
- CVE-2020-5254NetHack hilite_status parsing privilege escalationNetHack
- CVE-2012-1096NetworkManager 0.9 and earlier allows local users to use other users' certificates or private keys when making a connection via the file patGNOME NetworkManager
- CVE-2020-5253Privilege escalation in NetHackNetHack
- CVE-2012-1094JBoss AS 7 prior to 7.1.1 and mod_cluster do not handle default hostname in the same way, which can cause the excluded-contexts list to be mJBoss AS · org.jboss.as:jboss-as-server
- CVE-2020-10255Modern DRAM chips (DDR4 and LPDDR4 after 2015) are affected by a vulnerability in deployment of internal mitigations against RowHammer attac
- CVE-2019-13005An issue was discovered in GitLab Enterprise Edition and Community Edition 1.10 through 12.0.2.
- CVE-2019-13004An issue was discovered in GitLab Community and Enterprise Edition 11.10 through 12.0.2.
- CVE-2019-13003An issue was discovered in GitLab Community and Enterprise Edition before 12.0.3.
- CVE-2019-13002An issue was discovered in GitLab Community and Enterprise Edition 11.10 through 12.0.2.
- CVE-2019-13001An issue was discovered in GitLab Community and Enterprise Edition 11.9 and later through 12.0.2.
- CVE-2019-10705Western Digital SanDisk X600 devices in certain configurations, a vulnerability in the access control mechanism of the drive may allow data
- CVE-2019-12446An issue was discovered in GitLab Community and Enterprise Edition 8.3 through 11.11.
- CVE-2019-12445An issue was discovered in GitLab Community and Enterprise Edition 8.4 through 11.11.
- CVE-2019-12444An issue was discovered in GitLab Community and Enterprise Edition 8.9 through 11.11.
- CVE-2019-12443An issue was discovered in GitLab Community and Enterprise Edition 10.2 through 11.11.
- CVE-2019-12442An issue was discovered in GitLab Enterprise Edition 11.7 through 11.11.
- CVE-2019-12441An issue was discovered in GitLab Community and Enterprise Edition 8.4 through 11.11.
- CVE-2019-17636In Eclipse Theia versions 0.3.9 through 0.15.0, one of the default pre-packaged Theia extensions is "Mini-Browser", published as "@theia/minThe Eclipse Foundation Eclipse Theia · @theia/mini-browser
- CVE-2019-12434An issue was discovered in GitLab Community and Enterprise Edition 10.6 through 11.11.
- CVE-2019-12433An issue was discovered in GitLab Community and Enterprise Edition 11.7 through 11.11.
- CVE-2019-12432An issue was discovered in GitLab Community and Enterprise Edition 8.13 through 11.11.
- CVE-2019-12431An issue was discovered in GitLab Community and Enterprise Edition 8.13 through 11.11.
- CVE-2019-12430An issue was discovered in GitLab Community and Enterprise Edition 11.11.
- CVE-2019-12429An issue was discovered in GitLab Community and Enterprise Edition 11.9 through 11.11.
- CVE-2019-12428An issue was discovered in GitLab Community and Enterprise Edition 6.8 through 11.11.
- CVE-2019-11345Citrix SD-WAN Center 10.2.x before 10.2.1 and NetScaler SD-WAN Center 10.0.x before 10.0.7 allow XSS.
- CVE-2017-10992In HPE Storage Essentials 9.5.0.142, there is Unauthenticated Java Deserialization with remote code execution via OS commands in a request t
- CVE-2018-18894Certain older Lexmark devices (C, M, X, and 6500e before 2018-12-18) contain a directory traversal vulnerability in the embedded web server.
- CVE-2018-14502controllers/quizzes.php in the Kiboko Chained Quiz plugin before 1.0.9 for WordPress allows remote unauthenticated users to execute arbitrar
- CVE-2019-10706Western Digital SanDisk SanDisk X300, X300s, X400, and X600 devices: The firmware update authentication method relies on a symmetric HMAC di
- CVE-2019-10065An issue was discovered in Open Ticket Request System (OTRS) 7.0 through 7.0.6.
- CVE-2019-11686Western Digital SanDisk X300, X300s, X400, and X600 devices: A vulnerability in the wear-leveling algorithm of the drive may cause cryptogra
- CVE-2019-9859Vesta Control Panel (VestaCP) 0.9.7 through 0.9.8-23 is vulnerable to an authenticated command execution that can result in remote root acce
- CVE-2020-4162IBM InfoSphere Information Server 11.5 and 11.7 is vulnerable to cross-site scripting.IBM InfoSphere Information Server
- CVE-2019-4608IBM Tivoli Workload Scheduler 9.3 is vulnerable to cross-site scripting.IBM Workload Scheduler
- CVE-2020-10251In ImageMagick 7.0.9, an out-of-bounds read vulnerability exists within the ReadHEICImageByID function in coders\heic.c.