# CVEs published 2020-03-13

75 CVEs were published on March 13, 2020: 1 critical, 3 high. Days are UTC.

- [CVE-2020-10564](https://cve.now/CVE-2020-10564.md): An issue was discovered in the File Upload plugin before 4.13.0 for WordPress. (no CVSS)
- [CVE-2020-5240](https://cve.now/CVE-2020-5240.md): 2FA bypass through deleting devices in wagtail-2fa (CVSS 7.6, Lab Digital wagtail-2fa · wagtail-2fa)
- [CVE-2020-5257](https://cve.now/CVE-2020-5257.md): Sort order SQL injection in Administrate (CVSS 7.7, thoughtbot administrate · administrate)
- [CVE-2020-10562](https://cve.now/CVE-2020-10562.md): An issue was discovered in DEVOME GRR before 3.4.1c. (no CVSS)
- [CVE-2020-10563](https://cve.now/CVE-2020-10563.md): An issue was discovered in DEVOME GRR before 3.4.1c. (no CVSS)
- [CVE-2019-3770](https://cve.now/CVE-2019-3770.md): Dell Wyse Management Suite versions prior to 1.4.1 contain a stored cross-site scripting vulnerability when unregistering a device. (CVSS 6.4, Dell Wyse Management Suite)
- [CVE-2019-3769](https://cve.now/CVE-2019-3769.md): Dell Wyse Management Suite versions prior to 1.4.1 contain a stored cross-site scripting vulnerability. (CVSS 6.4, Dell Wyse Management Suite)
- [CVE-2019-18578](https://cve.now/CVE-2019-18578.md): Dell EMC XtremIO XMS versions prior to 6.3.0 contain a stored cross-site scripting vulnerability. (CVSS 9.0, Dell XtremIO)
- [CVE-2019-18577](https://cve.now/CVE-2019-18577.md): Dell EMC XtremIO XMS versions prior to 6.3.0 contain an incorrect permission assignment vulnerability. (CVSS 6.7, Dell XtremIO)
- [CVE-2019-18576](https://cve.now/CVE-2019-18576.md): Dell EMC XtremIO XMS versions prior to 6.3.0 contain an information disclosure vulnerability where OS users’ passwords are logged in local f (CVSS 6.7, Dell XtremIO)
- [CVE-2019-19611](https://cve.now/CVE-2019-19611.md): An issue was discovered in Halvotec RaQuest 10.23.10801.0. (no CVSS)
- [CVE-2019-14299](https://cve.now/CVE-2019-14299.md): Ricoh SP C250DN 1.05 devices have an Authentication Method Vulnerable to Brute Force Attacks. (no CVSS)
- [CVE-2019-14303](https://cve.now/CVE-2019-14303.md): Ricoh SP C250DN 1.05 devices allow denial of service (issue 1 of 3). (no CVSS)
- [CVE-2019-14309](https://cve.now/CVE-2019-14309.md): Ricoh SP C250DN 1.05 devices have a fixed password. (no CVSS)
- [CVE-2019-14310](https://cve.now/CVE-2019-14310.md): Ricoh SP C250DN 1.05 devices allow denial of service (issue 2 of 3). (no CVSS)
- [CVE-2019-13192](https://cve.now/CVE-2019-13192.md): Some Brother printers (such as the HL-L8360CDW v1.20) were affected by a heap buffer overflow vulnerability as the IPP service did not parse (no CVSS)
- [CVE-2019-13193](https://cve.now/CVE-2019-13193.md): Some Brother printers (such as the HL-L8360CDW v1.20) were affected by a stack buffer overflow vulnerability as the web server did not parse (no CVSS)
- [CVE-2019-13194](https://cve.now/CVE-2019-13194.md): Some Brother printers (such as the HL-L8360CDW v1.20) were affected by different information disclosure vulnerabilities that provided sensit (no CVSS)
- [CVE-2019-13165](https://cve.now/CVE-2019-13165.md): Some Xerox printers (such as the Phaser 3320 V53.006.16.000) were affected by a buffer overflow vulnerability in the request parser of the I (no CVSS)
- [CVE-2019-13166](https://cve.now/CVE-2019-13166.md): Some Xerox printers (such as the Phaser 3320 V53.006.16.000) did not implement account lockout. (no CVSS)
- [CVE-2019-13167](https://cve.now/CVE-2019-13167.md): Multiple Stored XSS vulnerabilities were found in the Xerox Web Application, used by the Phaser 3320 V53.006.16.000 and other printers. (no CVSS)
- [CVE-2019-13168](https://cve.now/CVE-2019-13168.md): Some Xerox printers (such as the Phaser 3320 V53.006.16.000) were affected by a buffer overflow vulnerability in the attributes parser of th (no CVSS)
- [CVE-2019-13169](https://cve.now/CVE-2019-13169.md): Some Xerox printers (such as the Phaser 3320 V53.006.16.000) were affected by a buffer overflow vulnerability in the Content-Type HTTP Heade (no CVSS)
- [CVE-2019-13170](https://cve.now/CVE-2019-13170.md): Some Xerox printers (such as the Phaser 3320 V53.006.16.000) did not implement any mechanism to avoid CSRF attacks. (no CVSS)
- [CVE-2019-13171](https://cve.now/CVE-2019-13171.md): Some Xerox printers (such as the Phaser 3320 V53.006.16.000) were affected by one or more stack-based buffer overflow vulnerabilities in the (no CVSS)
- [CVE-2019-13172](https://cve.now/CVE-2019-13172.md): Some Xerox printers (such as the Phaser 3320 V53.006.16.000) were affected by a buffer overflow vulnerability in the Authentication Cookie o (no CVSS)
- [CVE-2019-13195](https://cve.now/CVE-2019-13195.md): The web application of some Kyocera printers (such as the ECOSYS M5526cdw 2R7\_2000.001.701) was vulnerable to path traversal, allowing an un (no CVSS)
- [CVE-2019-13196](https://cve.now/CVE-2019-13196.md): Some Kyocera printers (such as the ECOSYS M5526cdw 2R7\_2000.001.701) were affected by a buffer overflow vulnerability in the arg4 and arg9 p (no CVSS)
- [CVE-2019-13197](https://cve.now/CVE-2019-13197.md): Some Kyocera printers (such as the ECOSYS M5526cdw 2R7\_2000.001.701) were affected by a buffer overflow vulnerability in the URI paths of th (no CVSS)
- [CVE-2019-13198](https://cve.now/CVE-2019-13198.md): The web application of several Kyocera printers (such as the ECOSYS M5526cdw 2R7\_2000.001.701) was affected by Stored XSS. (no CVSS)
- [CVE-2019-13199](https://cve.now/CVE-2019-13199.md): Some Kyocera printers (such as the ECOSYS M5526cdw 2R7\_2000.001.701) did not implement any mechanism to avoid CSRF. (no CVSS)
- [CVE-2019-13200](https://cve.now/CVE-2019-13200.md): The web application of several Kyocera printers (such as the ECOSYS M5526cdw 2R7\_2000.001.701) was affected by Reflected XSS. (no CVSS)
- [CVE-2019-13201](https://cve.now/CVE-2019-13201.md): Some Kyocera printers (such as the ECOSYS M5526cdw 2R7\_2000.001.701) were affected by a buffer overflow vulnerability in the LPD service. (no CVSS)
- [CVE-2019-13202](https://cve.now/CVE-2019-13202.md): Some Kyocera printers (such as the ECOSYS M5526cdw 2R7\_2000.001.701) were affected by a buffer overflow vulnerability in the okhtmlfile and (no CVSS)
- [CVE-2019-13203](https://cve.now/CVE-2019-13203.md): Some Kyocera printers (such as the ECOSYS M5526cdw 2R7\_2000.001.701) were affected by an integer overflow vulnerability in the arg3 paramete (no CVSS)
- [CVE-2019-13204](https://cve.now/CVE-2019-13204.md): Some Kyocera printers (such as the ECOSYS M5526cdw 2R7\_2000.001.701) were affected by multiple buffer overflow vulnerabilities in the IPP se (no CVSS)
- [CVE-2019-13205](https://cve.now/CVE-2019-13205.md): All configuration parameters of certain Kyocera printers (such as the ECOSYS M5526cdw 2R7\_2000.001.701) were accessible by unauthenticated u (no CVSS)
- [CVE-2019-13206](https://cve.now/CVE-2019-13206.md): Some Kyocera printers (such as the ECOSYS M5526cdw 2R7\_2000.001.701) were affected by a buffer overflow vulnerability in multiple parameters (no CVSS)
- [CVE-2019-13393](https://cve.now/CVE-2019-13393.md): The Voo branded NETGEAR CG3700b custom firmware V2.02.03 uses the same default 8 character passphrase for the administrative console and the (no CVSS)
- [CVE-2019-13394](https://cve.now/CVE-2019-13394.md): The Voo branded NETGEAR CG3700b custom firmware V2.02.03 uses HTTP Basic Authentication over cleartext HTTP. (no CVSS)
- [CVE-2019-13395](https://cve.now/CVE-2019-13395.md): The Voo branded NETGEAR CG3700b custom firmware V2.02.03 allows CSRF against all /goform/ URIs. (no CVSS)
- [CVE-2020-10073](https://cve.now/CVE-2020-10073.md): GitLab EE 12.4.2 through 12.8.1 allows Denial of Service. (no CVSS)
- [CVE-2020-10074](https://cve.now/CVE-2020-10074.md): GitLab 10.1 through 12.8.1 has Incorrect Access Control. (no CVSS)
- [CVE-2020-10075](https://cve.now/CVE-2020-10075.md): GitLab 12.5 through 12.8.1 allows HTML Injection. (no CVSS)
- [CVE-2020-10076](https://cve.now/CVE-2020-10076.md): GitLab 12.1 through 12.8.1 allows XSS. (no CVSS)
- [CVE-2020-10077](https://cve.now/CVE-2020-10077.md): GitLab EE 3.0 through 12.8.1 allows SSRF. (no CVSS)
- [CVE-2020-10078](https://cve.now/CVE-2020-10078.md): GitLab 12.1 through 12.8.1 allows XSS. (no CVSS)
- [CVE-2020-10079](https://cve.now/CVE-2020-10079.md): GitLab 7.10 through 12.8.1 has Incorrect Access Control. (no CVSS)
- [CVE-2020-10080](https://cve.now/CVE-2020-10080.md): GitLab 8.3 through 12.8.1 allows Information Disclosure. (no CVSS)
- [CVE-2020-10081](https://cve.now/CVE-2020-10081.md): GitLab before 12.8.2 has Incorrect Access Control. (no CVSS)
- [CVE-2020-10082](https://cve.now/CVE-2020-10082.md): GitLab 12.2 through 12.8.1 allows Denial of Service. (no CVSS)
- [CVE-2020-10083](https://cve.now/CVE-2020-10083.md): GitLab 12.7 through 12.8.1 has Insecure Permissions. (no CVSS)
- [CVE-2020-10084](https://cve.now/CVE-2020-10084.md): GitLab EE 11.6 through 12.8.1 allows Information Disclosure. (no CVSS)
- [CVE-2020-10085](https://cve.now/CVE-2020-10085.md): GitLab 12.3.5 through 12.8.1 allows Information Disclosure. (no CVSS)
- [CVE-2020-10086](https://cve.now/CVE-2020-10086.md): GitLab 10.4 through 12.8.1 allows Directory Traversal. (no CVSS)
- [CVE-2020-10087](https://cve.now/CVE-2020-10087.md): GitLab before 12.8.2 allows Information Disclosure. (no CVSS)
- [CVE-2020-10088](https://cve.now/CVE-2020-10088.md): GitLab 12.5 through 12.8.1 has Insecure Permissions. (no CVSS)
- [CVE-2020-10089](https://cve.now/CVE-2020-10089.md): GitLab 8.11 through 12.8.1 allows a Denial of Service when using several features to recursively request eachother, (no CVSS)
- [CVE-2020-10090](https://cve.now/CVE-2020-10090.md): GitLab 11.7 through 12.8.1 allows Information Disclosure. (no CVSS)
- [CVE-2020-10218](https://cve.now/CVE-2020-10218.md): A Blind SQL Injection issue was discovered in Sapplica Sentrifugo 3.2 via the index.php/holidaygroups/add id parameter because of the Holida (no CVSS)
- [CVE-2020-10091](https://cve.now/CVE-2020-10091.md): GitLab 9.3 through 12.8.1 allows XSS. (no CVSS)
- [CVE-2019-19799](https://cve.now/CVE-2019-19799.md): Zoho ManageEngine Applications Manager before 14600 allows a remote unauthenticated attacker to disclose license related information via Wie (no CVSS)
- [CVE-2020-10092](https://cve.now/CVE-2020-10092.md): GitLab 12.1 through 12.8.1 allows XSS. (no CVSS)
- [CVE-2019-12182](https://cve.now/CVE-2019-12182.md): Directory Traversal in Safescan Timemoto and TA-8000 series version 1.0 allows unauthenticated remote attackers to execute code via the admi (no CVSS)
- [CVE-2020-10195](https://cve.now/CVE-2020-10195.md): The popup-builder plugin before 3.64.1 for WordPress allows information disclosure and settings modification, leading to in-scope privilege (no CVSS)
- [CVE-2020-10196](https://cve.now/CVE-2020-10196.md): An XSS vulnerability in the popup-builder plugin before 3.64.1 for WordPress allows remote attackers to inject arbitrary JavaScript into exi (no CVSS)
- [CVE-2019-19756](https://cve.now/CVE-2019-19756.md): An internal product security audit of Lenovo XClarity Administrator (LXCA) discovered Windows OS credentials, used to perform driver updates (CVSS 7.9, Lenovo XClarity Administrator)
- [CVE-2020-8571](https://cve.now/CVE-2020-8571.md): StorageGRID (formerly StorageGRID Webscale) versions 10.0.0 through 11.3 prior to 11.2.0.8 and 11.3.0.4 are susceptible to a vulnerability w (no CVSS, NetApp StorageGRID)
- [CVE-2019-6699](https://cve.now/CVE-2019-6699.md): An improper neutralization of input vulnerability in Fortinet FortiADC 5.3.3 and earlier may allow an attacker to execute a stored Cross Sit (no CVSS, Fortinet FortiADC)
- [CVE-2019-16157](https://cve.now/CVE-2019-16157.md): An information exposure vulnerability in Fortinet FortiWeb 6.2.0 CLI and earlier may allow an authenticated user to view sensitive informati (no CVSS, Fortinet FortiWeb)
- [CVE-2020-1953](https://cve.now/CVE-2020-1953.md): Apache Commons Configuration uses a third-party library to parse YAML files which by default allows the instantiation of classes if the YAML (no CVSS, Apache Commons Configuration · org.apache.commons:commons-c…)
- [CVE-2020-10544](https://cve.now/CVE-2020-10544.md): An XSS issue was discovered in tooltip/tooltip.js in PrimeTek PrimeFaces 7.0.11. (no CVSS, primefaces · org.primefaces:primefaces)
- [CVE-2009-5159](https://cve.now/CVE-2009-5159.md): Invision Power Board (aka IPB or IP.Board) 2.x through 3.0.4, when Internet Explorer 5 is used, allows XSS via a .txt attachment. (no CVSS)
- [CVE-2020-10541](https://cve.now/CVE-2020-10541.md): Zoho ManageEngine OpManager before 12.4.179 allows remote code execution via a specially crafted Mail Server Settings v1 API request. (no CVSS)
- [CVE-2020-10540](https://cve.now/CVE-2020-10540.md): Untis WebUntis before 2020.9.6 allows CSRF for certain combinations of rights and modules. (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2020-03-13
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.