# CVEs published 2020-03-11

44 CVEs were published on March 11, 2020: 4 critical, 7 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2019-5181](https://cve.now/CVE-2019-5181.md): An exploitable stack buffer overflow vulnerability vulnerability exists in the iocheckd service ‘I/O-Check’ functionality of WAGO PFC 200 Fi (no CVSS, WAGO PFC200)
- [CVE-2019-5180](https://cve.now/CVE-2019-5180.md): An exploitable stack buffer overflow vulnerability vulnerability exists in the iocheckd service ‘I/O-Check’ functionality of WAGO PFC 200 Fi (no CVSS, WAGO PFC200)
- [CVE-2019-5179](https://cve.now/CVE-2019-5179.md): An exploitable stack buffer overflow vulnerability vulnerability exists in the iocheckd service ‘I/O-Check’ functionality of WAGO PFC 200 Fi (no CVSS, WAGO PFC200)
- [CVE-2019-5178](https://cve.now/CVE-2019-5178.md): An exploitable stack buffer overflow vulnerability vulnerability exists in the iocheckd service ‘I/O-Check’ functionality of WAGO PFC 200 Fi (no CVSS, WAGO PFC200)
- [CVE-2019-5177](https://cve.now/CVE-2019-5177.md): An exploitable stack buffer overflow vulnerability vulnerability exists in the iocheckd service ‘I/O-Check’ functionality of WAGO PFC 200 Fi (no CVSS, WAGO PFC200)
- [CVE-2019-5176](https://cve.now/CVE-2019-5176.md): An exploitable stack buffer overflow vulnerability vulnerability exists in the iocheckd service ‘I/O-Check’ functionality of WAGO PFC 200 Fi (no CVSS, WAGO PFC200)
- [CVE-2019-5171](https://cve.now/CVE-2019-5171.md): An exploitable command injection vulnerability exists in the iocheckd service ‘I/O-Check’ function of the WAGO PFC 200 Firmware version 03.0 (no CVSS, WAGO PFC200)
- [CVE-2019-5170](https://cve.now/CVE-2019-5170.md): An exploitable command injection vulnerability exists in the iocheckd service ‘I/O-Check’ function of the WAGO PFC 200 Firmware version 03.0 (no CVSS, WAGO PFC200)
- [CVE-2019-5169](https://cve.now/CVE-2019-5169.md): An exploitable command injection vulnerability exists in the iocheckd service ‘I/O-Check’ function of the WAGO PFC 200 Firmware version 03.0 (no CVSS, WAGO PFC200)
- [CVE-2019-5174](https://cve.now/CVE-2019-5174.md): An exploitable command injection vulnerability exists in the iocheckd service ‘I/O-Check’ function of the WAGO PFC 200 version 03.02.02(14). (no CVSS, WAGO PFC200 Firmware)
- [CVE-2019-5175](https://cve.now/CVE-2019-5175.md): An exploitable command injection vulnerability exists in the iocheckd service ‘I/O-Check’ function of the WAGO PFC 200 Firmware version 03.0 (no CVSS, WAGO PFC200)
- [CVE-2019-5172](https://cve.now/CVE-2019-5172.md): An exploitable command injection vulnerability exists in the iocheckd service ‘I/O-Check’ function of the WAGO PFC 200 Firmware version 03.0 (no CVSS, WAGO PFC200)
- [CVE-2019-5173](https://cve.now/CVE-2019-5173.md): An exploitable command injection vulnerability exists in the iocheckd service ‘I/O-Check’ function of the WAGO PFC 200 Firmware version 03.0 (no CVSS, WAGO PFC200)
- [CVE-2019-5182](https://cve.now/CVE-2019-5182.md): An exploitable stack buffer overflow vulnerability vulnerability exists in the iocheckd service ‘I/O-Check’ functionality of WAGO PFC 200 Fi (no CVSS, WAGO PFC200)
- [CVE-2019-10808](https://cve.now/CVE-2019-10808.md): utilitify prior to 1.0.3 allows modification of object properties. (no CVSS, utilitify)
- [CVE-2020-7943](https://cve.now/CVE-2020-7943.md): Puppet Server and PuppetDB provide useful performance and debugging information via their metrics API endpoints. (no CVSS, Puppet Enterprise 2018.1.x stream · Puppet Enterprise +3)
- [CVE-2020-7598](https://cve.now/CVE-2020-7598.md): minimist before 1.2.2 could be tricked into adding or modifying properties of Object.prototype using a "constructor" or "\_\_proto\_\_" payload. (no CVSS, minimist)
- [CVE-2020-5958](https://cve.now/CVE-2020-5958.md): NVIDIA Windows GPU Display Driver, all versions, contains a vulnerability in the NVIDIA Control Panel component in which an attacker with lo (no CVSS, NVIDIA GPU Display Driver)
- [CVE-2020-1947](https://cve.now/CVE-2020-1947.md): In Apache ShardingSphere(incubator) 4.0.0-RC3 and 4.0.0, the ShardingSphere's web console uses the SnakeYAML library for parsing YAML inputs (no CVSS, Apache Software Foundation Apache ShardingSphere · org.apac…)
- [CVE-2020-9408](https://cve.now/CVE-2020-9408.md): TIBCO Spotfire Server Script Trust Problem Exposes Remote Code Execution Vulnerability (CVSS 9.9, TIBCO Software TIBCO Spotfire Analytics Platform for AWS Ma…)
- [CVE-2016-1000111](https://cve.now/CVE-2016-1000111.md): Twisted before 16.3.1 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect CGI application (no CVSS, twisted)
- [CVE-2020-1979](https://cve.now/CVE-2020-1979.md): PAN-OS: A format string vulnerability in PAN-OS log daemon (logd) on Panorama allows local privilege escalation (CVSS 8.1, Palo Alto Networks PAN-OS)
- [CVE-2020-1980](https://cve.now/CVE-2020-1980.md): PAN-OS: Shell injection vulnerability in PAN-OS CLI allows execution of shell commands (CVSS 7.8, Palo Alto Networks PAN-OS)
- [CVE-2020-1981](https://cve.now/CVE-2020-1981.md): PAN-OS: Predictable temporary filename vulnerability allows local privilege escalation (CVSS 7.0, Palo Alto Networks PAN-OS)
- [CVE-2020-1733](https://cve.now/CVE-2020-1733.md): A race condition flaw was found in Ansible Engine 2.7.17 and prior, 2.8.9 and prior, 2.9.6 and prior when running a playbook with an unprivi (CVSS 5.0, Red Hat Ansible · ansible)
- [CVE-2013-1753](https://cve.now/CVE-2013-1753.md): The gzip\_decode function in the xmlrpc client library in Python 3.4 and earlier allows remote attackers to cause a denial of service (memory (no CVSS)
- [CVE-2020-8540](https://cve.now/CVE-2020-8540.md): An XML external entity (XXE) vulnerability in Zoho ManageEngine Desktop Central before the 07-Mar-2020 update allows remote unauthenticated (no CVSS)
- [CVE-2011-2487](https://cve.now/CVE-2011-2487.md): The implementations of PKCS#1 v1.5 key transport mechanism for XMLEncryption in JBossWS and Apache WSS4J before 1.6.5 is susceptible to a Bl (no CVSS, Apache WSS4J · Red Hat JBossWS +2)
- [CVE-2020-10181](https://cve.now/CVE-2020-10181.md): goform/formEMR30 in Sumavision Enhanced Multimedia Router (EMR) 3.0.4.27 allows creation of arbitrary users with elevated privileges (admini (CVSS 9.8, KEV)
- [CVE-2012-1101](https://cve.now/CVE-2012-1101.md): systemd 37-1 does not properly handle non-existent services, which causes a denial of service (failure of login procedure). (no CVSS, systemd)
- [CVE-2019-9095](https://cve.now/CVE-2019-9095.md): An issue was discovered on Moxa MGate MB3170 and MB3270 devices before 4.1, MB3280 and MB3480 devices before 3.1, MB3660 devices before 2.3, (CVSS 6.2)
- [CVE-2019-9096](https://cve.now/CVE-2019-9096.md): An issue was discovered on Moxa MGate MB3170 and MB3270 devices before 4.1, MB3280 and MB3480 devices before 3.1, MB3660 devices before 2.3, (CVSS 9.8)
- [CVE-2019-9097](https://cve.now/CVE-2019-9097.md): An issue was discovered on Moxa MGate MB3170 and MB3270 devices before 4.1, MB3280 and MB3480 devices before 3.1, MB3660 devices before 2.3, (CVSS 7.5)
- [CVE-2019-9098](https://cve.now/CVE-2019-9098.md): An issue was discovered on Moxa MGate MB3170 and MB3270 devices before 4.1, MB3280 and MB3480 devices before 3.1, MB3660 devices before 2.3, (CVSS 7.5)
- [CVE-2019-9099](https://cve.now/CVE-2019-9099.md): An issue was discovered on Moxa MGate MB3170 and MB3270 devices before 4.1, MB3280 and MB3480 devices before 3.1, MB3660 devices before 2.3, (CVSS 7.5)
- [CVE-2019-9101](https://cve.now/CVE-2019-9101.md): An issue was discovered on Moxa MGate MB3170 and MB3270 devices before 4.1, MB3280 and MB3480 devices before 3.1, MB3660 devices before 2.3, (CVSS 8.8)
- [CVE-2019-9102](https://cve.now/CVE-2019-9102.md): An issue was discovered on Moxa MGate MB3170 and MB3270 devices before 4.1, MB3280 and MB3480 devices before 3.1, MB3660 devices before 2.3, (CVSS 6.5)
- [CVE-2019-9103](https://cve.now/CVE-2019-9103.md): An issue was discovered on Moxa MGate MB3170 and MB3270 devices before 4.1, MB3280 and MB3480 devices before 3.1, MB3660 devices before 2.3, (CVSS 5.3)
- [CVE-2019-9104](https://cve.now/CVE-2019-9104.md): An issue was discovered on Moxa MGate MB3170 and MB3270 devices before 4.1, MB3280 and MB3480 devices before 3.1, MB3660 devices before 2.3, (CVSS 9.8)
- [CVE-2020-10376](https://cve.now/CVE-2020-10376.md): Technicolor TC7337NET 08.89.17.23.03 devices allow remote attackers to discover passwords by sniffing the network for an "Authorization: Bas (no CVSS)
- [CVE-2020-5203](https://cve.now/CVE-2020-5203.md): In Fat-Free Framework 3.7.1, attackers can achieve arbitrary code execution if developers choose to pass user controlled input (e.g., $\_REQU (no CVSS, bcosca/fatfree)
- [CVE-2019-19381](https://cve.now/CVE-2019-19381.md): oauth/oauth2/v1/saml/ in Abacus OAuth Login 2019\_01\_r4\_20191021\_0000 before prior to R4 (20.11.2019 Hotfix) allows Reflected Cross Site Scri (no CVSS)
- [CVE-2019-16107](https://cve.now/CVE-2019-16107.md): Missing form token validation in phpBB 3.2.7 allows CSRF in deleting post attachments. (no CVSS, phpbb/phpbb)
- [CVE-2020-10385](https://cve.now/CVE-2020-10385.md): A stored cross-site scripting (XSS) vulnerability exists in the WPForms Contact Form (aka wpforms-lite) plugin before 1.5.9 for WordPress. (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2020-03-11
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.