# CVEs published 2020-03-15

26 CVEs were published on March 15, 2020: 0 critical, 2 high. Days are UTC.

- [CVE-2019-15708](https://cve.now/CVE-2019-15708.md): A system command injection vulnerability in the FortiAP-S/W2 6.2.1, 6.2.0, 6.0.5 and below, FortiAP 6.0.5 and below and FortiAP-U below 6.0. (no CVSS, Fortinet FortiAP-S/W2 · Fortinet FortiAP-U +1)
- [CVE-2019-17654](https://cve.now/CVE-2019-17654.md): An Insufficient Verification of Data Authenticity vulnerability in FortiManager 6.2.1, 6.2.0, 6.0.6 and below may allow an unauthenticated a (no CVSS, Fortinet FortiManager)
- [CVE-2019-6696](https://cve.now/CVE-2019-6696.md): An improper input validation vulnerability in FortiOS 6.2.1, 6.2.0, 6.0.8 and below until 5.4.0 under admin webUI may allow an attacker to p (no CVSS, Fortinet FortiOS)
- [CVE-2020-9287](https://cve.now/CVE-2020-9287.md): A untrusted search path vulnerability in Fortinet may allow attacker to execute unauthorized code or commands via network exploitable (CVSS 7.5, Fortinet FortiClientEMS)
- [CVE-2020-9290](https://cve.now/CVE-2020-9290.md): A untrusted search path vulnerability in Fortinet may allow attacker to execute unauthorized code or commands via network exploitable (CVSS 7.1, Fortinet FortiClientWindows)
- [CVE-2020-7603](https://cve.now/CVE-2020-7603.md): closure-compiler-stream through 0.1.15 allows execution of arbitrary commands. (no CVSS, closure-compiler-stream)
- [CVE-2020-7607](https://cve.now/CVE-2020-7607.md): gulp-styledocco through 0.0.3 allows execution of arbitrary commands. (no CVSS, gulp-styledocco)
- [CVE-2020-7605](https://cve.now/CVE-2020-7605.md): gulp-tape through 1.0.0 allows execution of arbitrary commands. (no CVSS, gulp-tape)
- [CVE-2020-7606](https://cve.now/CVE-2020-7606.md): docker-compose-remote-api through 0.1.4 allows execution of arbitrary commands. (no CVSS, docker-compose-remote-api)
- [CVE-2020-7604](https://cve.now/CVE-2020-7604.md): pulverizr through 0.7.0 allows execution of arbitrary commands. (no CVSS, pulverizr)
- [CVE-2020-7602](https://cve.now/CVE-2020-7602.md): node-prompt-here through 1.0.1 allows execution of arbitrary commands. (no CVSS, node-prompt-here)
- [CVE-2020-7601](https://cve.now/CVE-2020-7601.md): gulp-scss-lint through 1.0.0 allows execution of arbitrary commands. (no CVSS, gulp-scss-lint)
- [CVE-2020-10594](https://cve.now/CVE-2020-10594.md): An issue was discovered in drf-jwt 1.15.x before 1.15.1. (no CVSS, drf-jwt)
- [CVE-2019-9474](https://cve.now/CVE-2019-9474.md): In Bluetooth, there is a possible out of bounds read due to a missing bounds check. (no CVSS, Android)
- [CVE-2019-9473](https://cve.now/CVE-2019-9473.md): In Bluetooth, there is a possible out of bounds read due to a missing bounds check. (no CVSS, Android)
- [CVE-2020-0088](https://cve.now/CVE-2020-0088.md): In parseTrackFragmentRun of MPEG4Extractor.cpp, there is possible resource exhaustion due to improper input validation. (no CVSS, Android)
- [CVE-2020-0086](https://cve.now/CVE-2020-0086.md): In readCString of Parcel.cpp, there is a possible out of bounds write due to an integer overflow. (no CVSS, Android)
- [CVE-2019-2058](https://cve.now/CVE-2019-2058.md): In libAACdec, there is a possible out of bounds read. (no CVSS, Android)
- [CVE-2019-2088](https://cve.now/CVE-2019-2088.md): In StatsService, there is a possible out of bounds read. (no CVSS, Android)
- [CVE-2019-2089](https://cve.now/CVE-2019-2089.md): In app uninstallation, there is a possible set of permissions that may not be removed from a shared app ID. (no CVSS, Android)
- [CVE-2019-2216](https://cve.now/CVE-2019-2216.md): In overlay notifications, there is a possible hidden notification due to improper input validation. (no CVSS, Android)
- [CVE-2020-10591](https://cve.now/CVE-2020-10591.md): An issue was discovered in Walmart Labs Concord before 1.44.0. (no CVSS, com.walmartlabs.concord:concord-common)
- [CVE-2020-10589](https://cve.now/CVE-2020-10589.md): v2rayL 2.1.3 allows local users to achieve root access because /etc/v2rayL/config.json is owned by a low-privileged user but contains comman (no CVSS)
- [CVE-2020-10588](https://cve.now/CVE-2020-10588.md): v2rayL 2.1.3 allows local users to achieve root access because /etc/v2rayL/add.sh and /etc/v2rayL/remove.sh are owned by a low-privileged us (no CVSS)
- [CVE-2019-15608](https://cve.now/CVE-2019-15608.md): The package integrity validation in yarn \< 1.19.0 contains a TOCTOU vulnerability where the hash is computed before writing a package to cac (no CVSS, yarn)
- [CVE-2020-8141](https://cve.now/CVE-2020-8141.md): The dot package v1.1.2 uses Function() to compile templates. (no CVSS, dot)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2020-03-15
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.