CVEs published March 13, 2020
75 CVEs were published on March 13, 2020: 1 critical, 3 high.
- Published
- 75
- Critical
- 1
- High
- 3
- Medium
- 4
- Low
- 0
- Unrated
- 67
- Now in CISA KEV
- 0
- Fix available
- 10
Most affected products
- Dell XtremIO
- 3
- Dell Wyse Management Suite
- 2
- Apache Commons Configuration · org.apache.commons:commons-c…
- 1
- Fortinet FortiADC
- 1
- Fortinet FortiWeb
- 1
- Lab Digital wagtail-2fa · wagtail-2fa
- 1
- Lenovo XClarity Administrator
- 1
- NetApp StorageGRID
- 1
- primefaces · org.primefaces:primefaces
- 1
- thoughtbot administrate · administrate
- 1
Critical 1
High 3
- CVE-2020-52402FA bypass through deleting devices in wagtail-2faLab Digital wagtail-2fa · wagtail-2fa
- CVE-2020-5257Sort order SQL injection in Administratethoughtbot administrate · administrate
- CVE-2019-19756An internal product security audit of Lenovo XClarity Administrator (LXCA) discovered Windows OS credentials, used to perform driver updatesLenovo XClarity Administrator
Medium, low and unrated 71
- CVE-2020-10564An issue was discovered in the File Upload plugin before 4.13.0 for WordPress.
- CVE-2020-10562An issue was discovered in DEVOME GRR before 3.4.1c.
- CVE-2020-10563An issue was discovered in DEVOME GRR before 3.4.1c.
- CVE-2019-3770Dell Wyse Management Suite versions prior to 1.4.1 contain a stored cross-site scripting vulnerability when unregistering a device.Dell Wyse Management Suite
- CVE-2019-3769Dell Wyse Management Suite versions prior to 1.4.1 contain a stored cross-site scripting vulnerability.Dell Wyse Management Suite
- CVE-2019-18577Dell EMC XtremIO XMS versions prior to 6.3.0 contain an incorrect permission assignment vulnerability.Dell XtremIO
- CVE-2019-18576Dell EMC XtremIO XMS versions prior to 6.3.0 contain an information disclosure vulnerability where OS users’ passwords are logged in local fDell XtremIO
- CVE-2019-19611An issue was discovered in Halvotec RaQuest 10.23.10801.0.
- CVE-2019-14299Ricoh SP C250DN 1.05 devices have an Authentication Method Vulnerable to Brute Force Attacks.
- CVE-2019-14303Ricoh SP C250DN 1.05 devices allow denial of service (issue 1 of 3).
- CVE-2019-14309Ricoh SP C250DN 1.05 devices have a fixed password.
- CVE-2019-14310Ricoh SP C250DN 1.05 devices allow denial of service (issue 2 of 3).
- CVE-2019-13192Some Brother printers (such as the HL-L8360CDW v1.20) were affected by a heap buffer overflow vulnerability as the IPP service did not parse
- CVE-2019-13193Some Brother printers (such as the HL-L8360CDW v1.20) were affected by a stack buffer overflow vulnerability as the web server did not parse
- CVE-2019-13194Some Brother printers (such as the HL-L8360CDW v1.20) were affected by different information disclosure vulnerabilities that provided sensit
- CVE-2019-13165Some Xerox printers (such as the Phaser 3320 V53.006.16.000) were affected by a buffer overflow vulnerability in the request parser of the I
- CVE-2019-13166Some Xerox printers (such as the Phaser 3320 V53.006.16.000) did not implement account lockout.
- CVE-2019-13167Multiple Stored XSS vulnerabilities were found in the Xerox Web Application, used by the Phaser 3320 V53.006.16.000 and other printers.
- CVE-2019-13168Some Xerox printers (such as the Phaser 3320 V53.006.16.000) were affected by a buffer overflow vulnerability in the attributes parser of th
- CVE-2019-13169Some Xerox printers (such as the Phaser 3320 V53.006.16.000) were affected by a buffer overflow vulnerability in the Content-Type HTTP Heade
- CVE-2019-13170Some Xerox printers (such as the Phaser 3320 V53.006.16.000) did not implement any mechanism to avoid CSRF attacks.
- CVE-2019-13171Some Xerox printers (such as the Phaser 3320 V53.006.16.000) were affected by one or more stack-based buffer overflow vulnerabilities in the
- CVE-2019-13172Some Xerox printers (such as the Phaser 3320 V53.006.16.000) were affected by a buffer overflow vulnerability in the Authentication Cookie o
- CVE-2019-13195The web application of some Kyocera printers (such as the ECOSYS M5526cdw 2R7_2000.001.701) was vulnerable to path traversal, allowing an un
- CVE-2019-13196Some Kyocera printers (such as the ECOSYS M5526cdw 2R7_2000.001.701) were affected by a buffer overflow vulnerability in the arg4 and arg9 p
- CVE-2019-13197Some Kyocera printers (such as the ECOSYS M5526cdw 2R7_2000.001.701) were affected by a buffer overflow vulnerability in the URI paths of th
- CVE-2019-13198The web application of several Kyocera printers (such as the ECOSYS M5526cdw 2R7_2000.001.701) was affected by Stored XSS.
- CVE-2019-13199Some Kyocera printers (such as the ECOSYS M5526cdw 2R7_2000.001.701) did not implement any mechanism to avoid CSRF.
- CVE-2019-13200The web application of several Kyocera printers (such as the ECOSYS M5526cdw 2R7_2000.001.701) was affected by Reflected XSS.
- CVE-2019-13201Some Kyocera printers (such as the ECOSYS M5526cdw 2R7_2000.001.701) were affected by a buffer overflow vulnerability in the LPD service.
- CVE-2019-13202Some Kyocera printers (such as the ECOSYS M5526cdw 2R7_2000.001.701) were affected by a buffer overflow vulnerability in the okhtmlfile and
- CVE-2019-13203Some Kyocera printers (such as the ECOSYS M5526cdw 2R7_2000.001.701) were affected by an integer overflow vulnerability in the arg3 paramete
- CVE-2019-13204Some Kyocera printers (such as the ECOSYS M5526cdw 2R7_2000.001.701) were affected by multiple buffer overflow vulnerabilities in the IPP se
- CVE-2019-13205All configuration parameters of certain Kyocera printers (such as the ECOSYS M5526cdw 2R7_2000.001.701) were accessible by unauthenticated u
- CVE-2019-13206Some Kyocera printers (such as the ECOSYS M5526cdw 2R7_2000.001.701) were affected by a buffer overflow vulnerability in multiple parameters
- CVE-2019-13393The Voo branded NETGEAR CG3700b custom firmware V2.02.03 uses the same default 8 character passphrase for the administrative console and the
- CVE-2019-13394The Voo branded NETGEAR CG3700b custom firmware V2.02.03 uses HTTP Basic Authentication over cleartext HTTP.
- CVE-2019-13395The Voo branded NETGEAR CG3700b custom firmware V2.02.03 allows CSRF against all /goform/ URIs.
- CVE-2020-10073GitLab EE 12.4.2 through 12.8.1 allows Denial of Service.
- CVE-2020-10074GitLab 10.1 through 12.8.1 has Incorrect Access Control.
- CVE-2020-10075GitLab 12.5 through 12.8.1 allows HTML Injection.
- CVE-2020-10076GitLab 12.1 through 12.8.1 allows XSS.
- CVE-2020-10077GitLab EE 3.0 through 12.8.1 allows SSRF.
- CVE-2020-10078GitLab 12.1 through 12.8.1 allows XSS.
- CVE-2020-10079GitLab 7.10 through 12.8.1 has Incorrect Access Control.
- CVE-2020-10080GitLab 8.3 through 12.8.1 allows Information Disclosure.
- CVE-2020-10081GitLab before 12.8.2 has Incorrect Access Control.
- CVE-2020-10082GitLab 12.2 through 12.8.1 allows Denial of Service.
- CVE-2020-10083GitLab 12.7 through 12.8.1 has Insecure Permissions.
- CVE-2020-10084GitLab EE 11.6 through 12.8.1 allows Information Disclosure.
- CVE-2020-10085GitLab 12.3.5 through 12.8.1 allows Information Disclosure.
- CVE-2020-10086GitLab 10.4 through 12.8.1 allows Directory Traversal.
- CVE-2020-10087GitLab before 12.8.2 allows Information Disclosure.
- CVE-2020-10088GitLab 12.5 through 12.8.1 has Insecure Permissions.
- CVE-2020-10089GitLab 8.11 through 12.8.1 allows a Denial of Service when using several features to recursively request eachother,
- CVE-2020-10090GitLab 11.7 through 12.8.1 allows Information Disclosure.
- CVE-2020-10218A Blind SQL Injection issue was discovered in Sapplica Sentrifugo 3.2 via the index.php/holidaygroups/add id parameter because of the Holida
- CVE-2020-10091GitLab 9.3 through 12.8.1 allows XSS.
- CVE-2019-19799Zoho ManageEngine Applications Manager before 14600 allows a remote unauthenticated attacker to disclose license related information via Wie
- CVE-2020-10092GitLab 12.1 through 12.8.1 allows XSS.
- CVE-2019-12182Directory Traversal in Safescan Timemoto and TA-8000 series version 1.0 allows unauthenticated remote attackers to execute code via the admi
- CVE-2020-10195The popup-builder plugin before 3.64.1 for WordPress allows information disclosure and settings modification, leading to in-scope privilege
- CVE-2020-10196An XSS vulnerability in the popup-builder plugin before 3.64.1 for WordPress allows remote attackers to inject arbitrary JavaScript into exi
- CVE-2020-8571StorageGRID (formerly StorageGRID Webscale) versions 10.0.0 through 11.3 prior to 11.2.0.8 and 11.3.0.4 are susceptible to a vulnerability wNetApp StorageGRID
- CVE-2019-6699An improper neutralization of input vulnerability in Fortinet FortiADC 5.3.3 and earlier may allow an attacker to execute a stored Cross SitFortinet FortiADC
- CVE-2019-16157An information exposure vulnerability in Fortinet FortiWeb 6.2.0 CLI and earlier may allow an authenticated user to view sensitive informatiFortinet FortiWeb
- CVE-2020-1953Apache Commons Configuration uses a third-party library to parse YAML files which by default allows the instantiation of classes if the YAMLApache Commons Configuration · org.apache.commons:commons-c…
- CVE-2020-10544An XSS issue was discovered in tooltip/tooltip.js in PrimeTek PrimeFaces 7.0.11.primefaces · org.primefaces:primefaces
- CVE-2009-5159Invision Power Board (aka IPB or IP.Board) 2.x through 3.0.4, when Internet Explorer 5 is used, allows XSS via a .txt attachment.
- CVE-2020-10541Zoho ManageEngine OpManager before 12.4.179 allows remote code execution via a specially crafted Mail Server Settings v1 API request.
- CVE-2020-10540Untis WebUntis before 2020.9.6 allows CSRF for certain combinations of rights and modules.