# CVEs published 2020-03-10

143 CVEs were published on March 10, 2020: 4 critical, 14 high. 3 are now in CISA KEV. Days are UTC.

- [CVE-2019-5106](https://cve.now/CVE-2019-5106.md): A hard-coded encryption key vulnerability exists in the authentication functionality of WAGO e!Cockpit version 1.5.1.1. (no CVSS, WAGO e!Cockpit)
- [CVE-2019-5107](https://cve.now/CVE-2019-5107.md): A cleartext transmission vulnerability exists in the network communication functionality of WAGO e!Cockpit version 1.5.1.1. (no CVSS, WAGO e!Cockpit)
- [CVE-2019-5134](https://cve.now/CVE-2019-5134.md): An exploitable regular expression without anchors vulnerability exists in the Web-Based Management (WBM) authentication functionality of WAG (no CVSS, WAGO PFC200 Firmware · WAGO PFC100 Firmware)
- [CVE-2019-5161](https://cve.now/CVE-2019-5161.md): An exploitable remote code execution vulnerability exists in the Cloud Connectivity functionality of WAGO PFC200 versions 03.02.02(14), 03.0 (no CVSS, WAGO PFC200 Firmware)
- [CVE-2019-10807](https://cve.now/CVE-2019-10807.md): Blamer versions prior to 1.0.1 allows execution of arbitrary commands. (no CVSS, blamer)
- [CVE-2019-5156](https://cve.now/CVE-2019-5156.md): An exploitable command injection vulnerability exists in the cloud connectivity functionality of WAGO PFC200 versions 03.02.02(14), 03.01.07 (no CVSS, WAGO PFC200 Firmware)
- [CVE-2019-5157](https://cve.now/CVE-2019-5157.md): An exploitable command injection vulnerability exists in the Cloud Connectivity functionality of WAGO PFC200 Firmware versions 03.02.02(14), (no CVSS, WAGO PFC200 Firmware)
- [CVE-2019-5158](https://cve.now/CVE-2019-5158.md): An exploitable firmware downgrade vulnerability exists in the firmware update package functionality of the WAGO e!COCKPIT automation softwar (no CVSS, WAGO e!COCKPIT)
- [CVE-2019-5159](https://cve.now/CVE-2019-5159.md): An exploitable improper input validation vulnerability exists in the firmware update functionality of WAGO e!COCKPIT automation software v1. (no CVSS, WAGO e!COCKPIT)
- [CVE-2019-5160](https://cve.now/CVE-2019-5160.md): An exploitable improper host validation vulnerability exists in the Cloud Connectivity functionality of WAGO PFC200 Firmware versions 03.02. (no CVSS, WAGO PFC200 Firmware)
- [CVE-2019-5168](https://cve.now/CVE-2019-5168.md): An exploitable command injection vulnerability exists in the iocheckd service ‘I/O-Check’ function of the WAGO PFC 200 version 03.02.02(14). (no CVSS, WAGO PFC200 Firmware)
- [CVE-2019-5167](https://cve.now/CVE-2019-5167.md): An exploitable command injection vulnerability exists in the iocheckd service ‘I/O-Check’ function of the WAGO PFC 200 version 03.02.02(14). (no CVSS, WAGO PFC200 Firmware)
- [CVE-2019-5166](https://cve.now/CVE-2019-5166.md): An exploitable stack buffer overflow vulnerability exists in the iocheckd service ‘I/O-Check’ functionality of WAGO PFC 200 version 03.02.02 (no CVSS, WAGO PFC200 Firmware)
- [CVE-2019-5135](https://cve.now/CVE-2019-5135.md): An exploitable timing discrepancy vulnerability exists in the authentication functionality of the Web-Based Management (WBM) web application (no CVSS, WAGO PFC200 Firmware · WAGO PFC100 Firmware)
- [CVE-2019-5149](https://cve.now/CVE-2019-5149.md): The WBM web application on firmwares prior to 03.02.02 and 03.01.07 on the WAGO PFC100 and PFC2000, respectively, runs on a lighttpd web ser (no CVSS, WAGO PFC200 Firmware · WAGO PFC100 Firmware)
- [CVE-2019-5155](https://cve.now/CVE-2019-5155.md): An exploitable command injection vulnerability exists in the cloud connectivity feature of WAGO PFC200. (no CVSS, WAGO PFC200 Firmware)
- [CVE-2019-3553](https://cve.now/CVE-2019-3553.md): C++ Facebook Thrift servers would not error upon receiving messages declaring containers of sizes larger than the payload. (no CVSS, Facebook Thrift)
- [CVE-2019-11938](https://cve.now/CVE-2019-11938.md): Java Facebook Thrift servers would not error upon receiving messages declaring containers of sizes larger than the payload. (no CVSS, Facebook Thrift)
- [CVE-2020-10372](https://cve.now/CVE-2020-10372.md): Ramp AltitudeCDN Altimeter before 2.4.0 allows authenticated Stored XSS via the vdms/ipmapping.jsp location field to the dms/rest/services/d (no CVSS)
- [CVE-2020-6210](https://cve.now/CVE-2020-6210.md): SAP Fiori Launchpad, versions- 753, 754, does not sufficiently encode user-controlled inputs, and hence allowing the attacker to inject the (CVSS 4.7, SAP SE SAP Fiori Launchpad)
- [CVE-2020-6209](https://cve.now/CVE-2020-6209.md): SAP Disclosure Management, version 10.1, does not perform necessary authorization checks for an authenticated user, allowing access to admin (CVSS 7.2, SAP SE SAP Disclosure Management)
- [CVE-2020-6208](https://cve.now/CVE-2020-6208.md): SAP Business Objects Business Intelligence Platform (Crystal Reports), versions- 4.1, 4.2, allows an attacker with basic authorization to in (CVSS 7.5, SAP SE SAP Business Objects Business Intelligence Platform)
- [CVE-2020-6207](https://cve.now/CVE-2020-6207.md): SAP Solution Manager (User Experience Monitoring), version- 7.2, due to Missing Authentication Check does not perform any authentication for (CVSS 10.0, KEV, SAP SE SAP Solution Manager)
- [CVE-2020-6206](https://cve.now/CVE-2020-6206.md): SAP Cloud Platform Integration for Data Services, version 1.0, allows user inputs to be reflected as error or warning massages. (CVSS 4.7, SAP SE SAP Cloud Platform Integration for Data Services)
- [CVE-2020-6205](https://cve.now/CVE-2020-6205.md): SAP NetWeaver AS ABAP Business Server Pages (Smart Forms), SAP\_BASIS versions- 7.00, 7.01, 7.02, 7.10, 7.11, 7.30, 7.31, 7.40, 7.50, 7.51, 7 (CVSS 6.1, SAP SE SAP NetWeaver Application Server ABAP (Smart Forms)…)
- [CVE-2020-6204](https://cve.now/CVE-2020-6204.md): The selection query in SAP Treasury and Risk Management (Transaction Management) (EA-FINSERV?versions 600, 603, 604, 605, 606, 616, 617, 618 (CVSS 4.3, SAP SE SAP Treasury and Risk Management (Transaction Manage…)
- [CVE-2020-6203](https://cve.now/CVE-2020-6203.md): SAP NetWeaver UDDI Server (Services Registry), versions- 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50; allows an attacker to exploit insufficien (CVSS 9.1, SAP SE SAP NetWeaver UDDI Server)
- [CVE-2020-6202](https://cve.now/CVE-2020-6202.md): SAP NetWeaver Application Server Java (User Management Engine), versions- 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50; does not sufficiently va (CVSS 5.5, SAP SE SAP NetWeaver Application Server Java)
- [CVE-2020-6201](https://cve.now/CVE-2020-6201.md): The SAP Commerce (Testweb Extension), versions- 6.6, 6.7, 1808, 1811, 1905, does not sufficiently encode user-controlled inputs, due to whic (CVSS 6.1, SAP SE SAP Commerce Cloud)
- [CVE-2020-6200](https://cve.now/CVE-2020-6200.md): The SAP Commerce (SmartEdit Extension), versions- 6.6, 6.7, 1808, 1811, is vulnerable to client-side angularjs template injection, a variant (CVSS 5.4, SAP SE SAP Commerce Cloud)
- [CVE-2020-6199](https://cve.now/CVE-2020-6199.md): The view FIMENAV\_COMPCERT in SAP ERP (MENA Certificate Management), EAPPGLO version 607, SAP\_FIN versions- 618, 730 and SAP S/4HANA (MENA Ce (CVSS 5.4, SAP SE SAP ERP · SAP SE SAP S/4HANA)
- [CVE-2020-6198](https://cve.now/CVE-2020-6198.md): SAP Solution Manager (Diagnostics Agent), version 720, allows unencrypted connections from unauthenticated sources. (CVSS 9.8, SAP SE SAP Solution Manager)
- [CVE-2020-6197](https://cve.now/CVE-2020-6197.md): SAP Enable Now, before version 1908, does not invalidate session tokens in a timely manner. (CVSS 3.8, SAP SE SAP Enable Now)
- [CVE-2020-6196](https://cve.now/CVE-2020-6196.md): SAP BusinessObjects Mobile (MobileBIService), version 4.2, allows an attacker to generate multiple requests, using which he can block all th (CVSS 7.5, SAP SE SAP BusinessObjects Mobile)
- [CVE-2020-6178](https://cve.now/CVE-2020-6178.md): SAP Enable Now, before version 1911, sends the Session ID cookie value in URL. (CVSS 5.4, SAP SE SAP Enable Now)
- [CVE-2020-0057](https://cve.now/CVE-2020-0057.md): In btm\_process\_inq\_results of btm\_inq.cc, there is a possible out of bounds read due to a missing bounds check. (no CVSS, Android)
- [CVE-2020-0056](https://cve.now/CVE-2020-0056.md): In btu\_hcif\_connection\_comp\_evt of btu\_hcif.cc, there is a possible out of bounds read due to a missing bounds check. (no CVSS, Android)
- [CVE-2020-0055](https://cve.now/CVE-2020-0055.md): In l2c\_link\_process\_num\_completed\_pkts of l2c\_link.cc, there is a possible out of bounds read due to a missing bounds check. (no CVSS, Android)
- [CVE-2020-0054](https://cve.now/CVE-2020-0054.md): In WifiNetworkSuggestionsManager of WifiNetworkSuggestionsManager.java, there is a possible permission revocation due to a missing permissio (no CVSS, Android)
- [CVE-2020-0053](https://cve.now/CVE-2020-0053.md): In convertHidlNanDataPathInitiatorRequestToLegacy, and convertHidlNanDataPathIndicationResponseToLegacy of hidl\_struct\_util.cpp, there is a (no CVSS, Android)
- [CVE-2020-0052](https://cve.now/CVE-2020-0052.md): In smsSelected of AnswerFragment.java, there is a way to send an SMS from the lock screen due to a permissions bypass. (no CVSS, Android)
- [CVE-2020-0085](https://cve.now/CVE-2020-0085.md): In setBluetoothTethering of PanService.java, there is a possible permission bypass due to a missing permission check. (no CVSS, Android)
- [CVE-2020-0051](https://cve.now/CVE-2020-0051.md): In onCreate of SettingsHomepageActivity, there is a possible tapjacking attack. (no CVSS, Android)
- [CVE-2020-0050](https://cve.now/CVE-2020-0050.md): In nfa\_hciu\_send\_msg of nfa\_hci\_utils.cc, there is a possible out of bounds write due to improper input validation. (no CVSS, Android)
- [CVE-2020-0049](https://cve.now/CVE-2020-0049.md): In onReadBuffer() of StreamingSource.cpp, there is a possible information disclosure due to uninitialized data. (no CVSS, Android)
- [CVE-2020-0048](https://cve.now/CVE-2020-0048.md): In onTransact of IAudioFlinger.cpp, there is a possible stack information leak due to uninitialized data. (no CVSS, Android)
- [CVE-2020-0047](https://cve.now/CVE-2020-0047.md): In setMasterMute of AudioService.java, there is a missing permission check. (no CVSS, Android)
- [CVE-2020-0046](https://cve.now/CVE-2020-0046.md): In DrmPlugin::releaseSecureStops of DrmPlugin.cpp, there is a possible out of bounds write due to a heap buffer overflow. (no CVSS, Android)
- [CVE-2020-0087](https://cve.now/CVE-2020-0087.md): In getProcessPss of ActivityManagerService.java, there is a possible side channel information disclosure. (no CVSS, Android)
- [CVE-2020-0084](https://cve.now/CVE-2020-0084.md): In several functions of NotificationManagerService.java, there are missing permission checks. (no CVSS, Android)
- [CVE-2020-0062](https://cve.now/CVE-2020-0062.md): In Euicc, there is a possible information disclosure due to an included test Certificate. (no CVSS, Android)
- [CVE-2020-0066](https://cve.now/CVE-2020-0066.md): In the netlink driver, there is a possible out of bounds write due to a race condition. (no CVSS, Android)
- [CVE-2020-0063](https://cve.now/CVE-2020-0063.md): In SurfaceFlinger, it is possible to override UI confirmation screen protected by the TEE. (no CVSS, Android)
- [CVE-2020-0045](https://cve.now/CVE-2020-0045.md): In StatsService::command of StatsService.cpp, there is possible memory corruption due to a race condition. (no CVSS, Android)
- [CVE-2020-0061](https://cve.now/CVE-2020-0061.md): In Pixel Recorder, there is a possible permissions bypass allowing arbitrary apps to record audio. (no CVSS, Android)
- [CVE-2020-0083](https://cve.now/CVE-2020-0083.md): In setRequirePmfInternal of sta\_network.cpp, there is a possible default value being improperly applied due to a logic error. (no CVSS, Android)
- [CVE-2020-0060](https://cve.now/CVE-2020-0060.md): In query of SmsProvider.java and MmsSmsProvider.java, there is a possible permission bypass due to SQL injection. (no CVSS, Android)
- [CVE-2020-0059](https://cve.now/CVE-2020-0059.md): In btm\_ble\_batchscan\_filter\_track\_adv\_vse\_cback of btm\_ble\_batchscan.cc, there is a possible out of bounds read due to a missing bounds chec (no CVSS, Android)
- [CVE-2020-0058](https://cve.now/CVE-2020-0058.md): In l2c\_rcv\_acl\_data of l2c\_main.cc, there is a possible out of bounds read due to an incorrect bounds check. (no CVSS, Android)
- [CVE-2020-0069](https://cve.now/CVE-2020-0069.md): In the ioctl handlers of the Mediatek Command Queue driver, there is a possible out of bounds write due to insufficient input sanitization a (CVSS 7.8, KEV, Android)
- [CVE-2020-0044](https://cve.now/CVE-2020-0044.md): In set\_nonce of fpc\_ta\_qc\_auth.c, there is a possible out of bounds read due to a missing bounds check. (no CVSS, Android)
- [CVE-2020-0043](https://cve.now/CVE-2020-0043.md): In authorize\_enrol of fpc\_ta\_hw\_auth.c, there is a possible out of bounds read due to a missing bounds check. (no CVSS, Android)
- [CVE-2020-0042](https://cve.now/CVE-2020-0042.md): In fpc\_ta\_hw\_auth\_unwrap\_key of fpc\_ta\_hw\_auth\_qsee.c, there is a possible out of bounds read due to a missing bounds check. (no CVSS, Android)
- [CVE-2020-0041](https://cve.now/CVE-2020-0041.md): In binder\_transaction of binder.c, there is a possible out of bounds write due to an incorrect bounds check. (CVSS 7.8, KEV, Android)
- [CVE-2020-0039](https://cve.now/CVE-2020-0039.md): In rw\_i93\_sm\_update\_ndef of rw\_i93.cc, there is a possible read of uninitialized data due to a missing bounds check. (no CVSS, Android)
- [CVE-2020-0038](https://cve.now/CVE-2020-0038.md): In rw\_i93\_sm\_update\_ndef of rw\_i93.cc, there is a possible read of uninitialized data due to a missing bounds check. (no CVSS, Android)
- [CVE-2020-0037](https://cve.now/CVE-2020-0037.md): In rw\_i93\_sm\_set\_read\_only of rw\_i93.cc, there is a possible out of bounds read due to a missing bounds check. (no CVSS, Android)
- [CVE-2020-0036](https://cve.now/CVE-2020-0036.md): In hasPermissions of PermissionMonitor.java, there is a possible access to restricted permissions due to a permissions bypass. (no CVSS, Android)
- [CVE-2020-0035](https://cve.now/CVE-2020-0035.md): In query of TelephonyProvider.java, there is a possible access to SIM card info due to a missing permission check. (no CVSS, Android)
- [CVE-2020-0034](https://cve.now/CVE-2020-0034.md): In vp8\_decode\_frame of decodeframe.c, there is a possible out of bounds read due to improper input validation. (no CVSS, Android)
- [CVE-2020-0033](https://cve.now/CVE-2020-0033.md): In CryptoPlugin::decrypt of CryptoPlugin.cpp, there is a possible out of bounds write due to stale pointer. (no CVSS, Android)
- [CVE-2020-0032](https://cve.now/CVE-2020-0032.md): In ih264d\_release\_display\_bufs of ih264d\_utils.c, there is a possible out of bounds write due to a heap buffer overflow. (no CVSS, Android)
- [CVE-2020-0031](https://cve.now/CVE-2020-0031.md): In triggerAugmentedAutofillLocked and related functions of Session.java, it is possible for Augmented Autofill to display sensitive informat (no CVSS, Android)
- [CVE-2020-0029](https://cve.now/CVE-2020-0029.md): In the WifiConfigManager, there is a possible storage of location history which can only be deleted by triggering a factory reset. (no CVSS, Android)
- [CVE-2020-0012](https://cve.now/CVE-2020-0012.md): In fpc\_ta\_pn\_get\_unencrypted\_image of fpc\_ta\_pn.c, there is a possible out of bounds write due to a missing bounds check. (no CVSS, Android)
- [CVE-2020-0011](https://cve.now/CVE-2020-0011.md): In get\_auth\_result of fpc\_ta\_hw\_auth.c, there is a possible out of bounds write due to a missing bounds check. (no CVSS, Android)
- [CVE-2020-0010](https://cve.now/CVE-2020-0010.md): In fpc\_ta\_get\_build\_info of fpc\_ta\_kpi.c, there is a possible out of bounds write due to a missing bounds check. (no CVSS, Android)
- [CVE-2019-7589](https://cve.now/CVE-2019-7589.md): Kantech EntraPass Improper Input Validation (CVSS 9.8, Johnson Controls Kantech EntraPass Corporate Edition · John…)
- [CVE-2020-9044](https://cve.now/CVE-2020-9044.md): Metasys Improper Restriction of XML External Entity Reference (CVSS 7.5, Johnson Controls Metasys Application and Data Server · J… +8)
- [CVE-2019-18336](https://cve.now/CVE-2019-18336.md): A vulnerability has been identified in SIMATIC S7-300 CPU family (incl. (CVSS 7.5, Siemens AG SIMATIC S7-300 CPU family · Siemens AG SIMATI… +2)
- [CVE-2019-19277](https://cve.now/CVE-2019-19277.md): A vulnerability has been identified in SIPORT MP (All versions \< 3.1.4). (no CVSS, Siemens AG SIPORT MP)
- [CVE-2019-19279](https://cve.now/CVE-2019-19279.md): A vulnerability has been identified in SIPROTEC 4 and SIPROTEC Compact relays equipped with EN100 Ethernet communication modules (All versio (no CVSS, Siemens AG SIPROTEC 4 and SIPROTEC Compact relays equipped…)
- [CVE-2019-19281](https://cve.now/CVE-2019-19281.md): A vulnerability has been identified in SIMATIC ET 200SP Open Controller CPU 1515SP PC2 (incl. (no CVSS, Siemens AG SIMATIC ET 200SP Open Controller CPU 1515SP P… +1)
- [CVE-2019-19282](https://cve.now/CVE-2019-19282.md): A vulnerability has been identified in OpenPCS 7 V8.1 (All versions), OpenPCS 7 V8.2 (All versions), OpenPCS 7 V9.0 (All versions \< V9.0 Upd (CVSS 7.5, Siemens OpenPCS 7 · Siemens SIMATIC BATCH +5)
- [CVE-2019-19290](https://cve.now/CVE-2019-19290.md): A vulnerability has been identified in Control Center Server (CCS) (All versions \< V1.5.0). (CVSS 6.5, Siemens Control Center Server)
- [CVE-2019-19291](https://cve.now/CVE-2019-19291.md): A vulnerability has been identified in Control Center Server (CCS) (All versions \< V1.5.0), SiNVR/SiVMS Video Server (All versions \< V5.0.0) (CVSS 5.3, Siemens Control Center Server · Siemens SiNVR/SiVMS Video S…)
- [CVE-2019-19292](https://cve.now/CVE-2019-19292.md): A vulnerability has been identified in Control Center Server (CCS) (All versions \< V1.5.0). (CVSS 8.8, Siemens Control Center Server)
- [CVE-2019-19293](https://cve.now/CVE-2019-19293.md): A vulnerability has been identified in Control Center Server (CCS) (All versions \< V1.5.0). (CVSS 6.1, Siemens Control Center Server)
- [CVE-2019-19294](https://cve.now/CVE-2019-19294.md): A vulnerability has been identified in Control Center Server (CCS) (All versions \< V1.5.0). (CVSS 6.3, Siemens Control Center Server)
- [CVE-2019-19295](https://cve.now/CVE-2019-19295.md): A vulnerability has been identified in Control Center Server (CCS) (All versions \< V1.5.0). (CVSS 4.3, Siemens Control Center Server)
- [CVE-2019-19296](https://cve.now/CVE-2019-19296.md): A vulnerability has been identified in SiNVR/SiVMS Video Server (All versions \< V5.0.0). (CVSS 6.8, Siemens SiNVR/SiVMS Video Server)
- [CVE-2019-19297](https://cve.now/CVE-2019-19297.md): A vulnerability has been identified in SiNVR/SiVMS Video Server (All versions \< V5.0.0). (CVSS 7.5, Siemens SiNVR/SiVMS Video Server)
- [CVE-2019-19298](https://cve.now/CVE-2019-19298.md): A vulnerability has been identified in SiNVR/SiVMS Video Server (All versions \< V5.0.0), SiNVR/SiVMS Video Server (All versions \>= V5.0.0 \< (CVSS 7.5, Siemens SiNVR/SiVMS Video Server)
- [CVE-2019-19299](https://cve.now/CVE-2019-19299.md): A vulnerability has been identified in SiNVR/SiVMS Video Server (All versions \< V5.0.0), SiNVR/SiVMS Video Server (All versions \>= V5.0.0 \< (CVSS 7.5, Siemens SiNVR/SiVMS Video Server)
- [CVE-2019-6585](https://cve.now/CVE-2019-6585.md): A vulnerability has been identified in SCALANCE S602 (All versions \>= V3.0 and \< V4.1), SCALANCE S612 (All versions \>= V3.0 and \< V4.1), SCA (no CVSS, Siemens SCALANCE S602 · Siemens SCALANCE S612 +2)
- [CVE-2020-7579](https://cve.now/CVE-2020-7579.md): A vulnerability has been identified in Spectrum Power™ 5 (All versions \< v5.50 HF02). (no CVSS, Siemens AG Spectrum Power™)
- [CVE-2020-5258](https://cve.now/CVE-2020-5258.md): Prototype pollution in dojo (CVSS 7.7, dojo)
- [CVE-2020-5259](https://cve.now/CVE-2020-5259.md): Prototype Pollution in Dojox (CVSS 7.7, dojox)
- [CVE-2019-15034](https://cve.now/CVE-2019-15034.md): hw/display/bochs-display.c in QEMU 4.0.0 does not ensure a sufficient PCI config space allocation, leading to a buffer overflow involving th (no CVSS)
- [CVE-2019-13457](https://cve.now/CVE-2019-13457.md): An issue was discovered in Open Ticket Request System (OTRS) 7.0.x through 7.0.8. (CVSS 4.3)
- [CVE-2019-13121](https://cve.now/CVE-2019-13121.md): An issue was discovered in GitLab Enterprise Edition 10.6 through 12.0.2. (no CVSS)
- [CVE-2019-13011](https://cve.now/CVE-2019-13011.md): An issue was discovered in GitLab Enterprise Edition 8.11.0 through 12.0.2. (no CVSS)
- [CVE-2019-13010](https://cve.now/CVE-2019-13010.md): An issue was discovered in GitLab Enterprise Edition 8.3 through 12.0.2. (no CVSS)
- [CVE-2019-13009](https://cve.now/CVE-2019-13009.md): An issue was discovered in GitLab Community and Enterprise Edition 9.2 through 12.0.2. (no CVSS)
- [CVE-2019-13007](https://cve.now/CVE-2019-13007.md): An issue was discovered in GitLab Community and Enterprise Edition 11.11 through 12.0.2. (no CVSS)
- [CVE-2019-13006](https://cve.now/CVE-2019-13006.md): An issue was discovered in GitLab Community and Enterprise Edition 9.0 and through 12.0.2. (no CVSS)
- [CVE-2020-9440](https://cve.now/CVE-2020-9440.md): A cross-site scripting (XSS) vulnerability in the WSC plugin through 5.5.7.5 for CKEditor 4 allows remote attackers to run arbitrary web scr (no CVSS)
- [CVE-2020-5254](https://cve.now/CVE-2020-5254.md): NetHack hilite\_status parsing privilege escalation (CVSS 3.9, NetHack)
- [CVE-2012-1096](https://cve.now/CVE-2012-1096.md): NetworkManager 0.9 and earlier allows local users to use other users' certificates or private keys when making a connection via the file pat (no CVSS, GNOME NetworkManager)
- [CVE-2020-5253](https://cve.now/CVE-2020-5253.md): Privilege escalation in NetHack (CVSS 3.9, NetHack)
- [CVE-2012-1094](https://cve.now/CVE-2012-1094.md): JBoss AS 7 prior to 7.1.1 and mod\_cluster do not handle default hostname in the same way, which can cause the excluded-contexts list to be m (no CVSS, JBoss AS · org.jboss.as:jboss-as-server)
- [CVE-2020-10255](https://cve.now/CVE-2020-10255.md): Modern DRAM chips (DDR4 and LPDDR4 after 2015) are affected by a vulnerability in deployment of internal mitigations against RowHammer attac (no CVSS)
- [CVE-2019-13005](https://cve.now/CVE-2019-13005.md): An issue was discovered in GitLab Enterprise Edition and Community Edition 1.10 through 12.0.2. (no CVSS)
- [CVE-2019-13004](https://cve.now/CVE-2019-13004.md): An issue was discovered in GitLab Community and Enterprise Edition 11.10 through 12.0.2. (no CVSS)
- [CVE-2019-13003](https://cve.now/CVE-2019-13003.md): An issue was discovered in GitLab Community and Enterprise Edition before 12.0.3. (no CVSS)
- [CVE-2019-13002](https://cve.now/CVE-2019-13002.md): An issue was discovered in GitLab Community and Enterprise Edition 11.10 through 12.0.2. (no CVSS)
- [CVE-2019-13001](https://cve.now/CVE-2019-13001.md): An issue was discovered in GitLab Community and Enterprise Edition 11.9 and later through 12.0.2. (no CVSS)
- [CVE-2019-10705](https://cve.now/CVE-2019-10705.md): Western Digital SanDisk X600 devices in certain configurations, a vulnerability in the access control mechanism of the drive may allow data (no CVSS)
- [CVE-2019-12446](https://cve.now/CVE-2019-12446.md): An issue was discovered in GitLab Community and Enterprise Edition 8.3 through 11.11. (no CVSS)
- [CVE-2019-12445](https://cve.now/CVE-2019-12445.md): An issue was discovered in GitLab Community and Enterprise Edition 8.4 through 11.11. (no CVSS)
- [CVE-2019-12444](https://cve.now/CVE-2019-12444.md): An issue was discovered in GitLab Community and Enterprise Edition 8.9 through 11.11. (no CVSS)
- [CVE-2019-12443](https://cve.now/CVE-2019-12443.md): An issue was discovered in GitLab Community and Enterprise Edition 10.2 through 11.11. (no CVSS)
- [CVE-2019-12442](https://cve.now/CVE-2019-12442.md): An issue was discovered in GitLab Enterprise Edition 11.7 through 11.11. (no CVSS)
- [CVE-2019-12441](https://cve.now/CVE-2019-12441.md): An issue was discovered in GitLab Community and Enterprise Edition 8.4 through 11.11. (no CVSS)
- [CVE-2019-17636](https://cve.now/CVE-2019-17636.md): In Eclipse Theia versions 0.3.9 through 0.15.0, one of the default pre-packaged Theia extensions is "Mini-Browser", published as "@theia/min (no CVSS, The Eclipse Foundation Eclipse Theia · @theia/mini-browser)
- [CVE-2019-12434](https://cve.now/CVE-2019-12434.md): An issue was discovered in GitLab Community and Enterprise Edition 10.6 through 11.11. (no CVSS)
- [CVE-2019-12433](https://cve.now/CVE-2019-12433.md): An issue was discovered in GitLab Community and Enterprise Edition 11.7 through 11.11. (no CVSS)
- [CVE-2019-12432](https://cve.now/CVE-2019-12432.md): An issue was discovered in GitLab Community and Enterprise Edition 8.13 through 11.11. (no CVSS)
- [CVE-2019-12431](https://cve.now/CVE-2019-12431.md): An issue was discovered in GitLab Community and Enterprise Edition 8.13 through 11.11. (no CVSS)
- [CVE-2019-12430](https://cve.now/CVE-2019-12430.md): An issue was discovered in GitLab Community and Enterprise Edition 11.11. (no CVSS)
- [CVE-2019-12429](https://cve.now/CVE-2019-12429.md): An issue was discovered in GitLab Community and Enterprise Edition 11.9 through 11.11. (no CVSS)
- [CVE-2019-12428](https://cve.now/CVE-2019-12428.md): An issue was discovered in GitLab Community and Enterprise Edition 6.8 through 11.11. (no CVSS)
- [CVE-2019-11345](https://cve.now/CVE-2019-11345.md): Citrix SD-WAN Center 10.2.x before 10.2.1 and NetScaler SD-WAN Center 10.0.x before 10.0.7 allow XSS. (no CVSS)
- [CVE-2017-10992](https://cve.now/CVE-2017-10992.md): In HPE Storage Essentials 9.5.0.142, there is Unauthenticated Java Deserialization with remote code execution via OS commands in a request t (no CVSS)
- [CVE-2018-18894](https://cve.now/CVE-2018-18894.md): Certain older Lexmark devices (C, M, X, and 6500e before 2018-12-18) contain a directory traversal vulnerability in the embedded web server. (no CVSS)
- [CVE-2018-14502](https://cve.now/CVE-2018-14502.md): controllers/quizzes.php in the Kiboko Chained Quiz plugin before 1.0.9 for WordPress allows remote unauthenticated users to execute arbitrar (no CVSS)
- [CVE-2019-10706](https://cve.now/CVE-2019-10706.md): Western Digital SanDisk SanDisk X300, X300s, X400, and X600 devices: The firmware update authentication method relies on a symmetric HMAC di (no CVSS)
- [CVE-2019-10065](https://cve.now/CVE-2019-10065.md): An issue was discovered in Open Ticket Request System (OTRS) 7.0 through 7.0.6. (no CVSS)
- [CVE-2019-11686](https://cve.now/CVE-2019-11686.md): Western Digital SanDisk X300, X300s, X400, and X600 devices: A vulnerability in the wear-leveling algorithm of the drive may cause cryptogra (no CVSS)
- [CVE-2019-9859](https://cve.now/CVE-2019-9859.md): Vesta Control Panel (VestaCP) 0.9.7 through 0.9.8-23 is vulnerable to an authenticated command execution that can result in remote root acce (no CVSS)
- [CVE-2020-4162](https://cve.now/CVE-2020-4162.md): IBM InfoSphere Information Server 11.5 and 11.7 is vulnerable to cross-site scripting. (CVSS 5.4, IBM InfoSphere Information Server)
- [CVE-2019-4608](https://cve.now/CVE-2019-4608.md): IBM Tivoli Workload Scheduler 9.3 is vulnerable to cross-site scripting. (CVSS 5.4, IBM Workload Scheduler)
- [CVE-2020-10251](https://cve.now/CVE-2020-10251.md): In ImageMagick 7.0.9, an out-of-bounds read vulnerability exists within the ReadHEICImageByID function in coders\\heic.c. (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2020-03-10
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.