CVEs published March 16, 2020
89 CVEs were published on March 16, 2020: 3 critical, 3 high. 2 are now in CISA KEV.
- Published
- 89
- Critical
- 3
- High
- 3
- Medium
- 6
- Low
- 3
- Unrated
- 74
- Now in CISA KEV
- 2
- Fix available
- 15
Most affected products
- Mitsubishi Electric MELQIC IU1 series
- 6
- dolibarr/dolibarr
- 4
- Red Hat ansible · ansible
- 4
- Rockwell Automation MicroLogix 1400 Controllers Series B v2…
- 4
- IBM MQ
- 3
- VMware Workstation · VMware Fusion
- 2
- Apache Geode · org.apache.geode:geode-core
- 1
- codiad/codiad
- 1
- contao/contao · contao/core-bundle +1
- 1
- github.com/containous/traefik · github.com/containous/tr… +1
- 1
Critical 3
- CVE-2020-5847Unraid through 6.8.0 allows Remote Code Execution.
- CVE-2020-6984Rockwell Automation MicroLogix 1400 Controllers Series B v21.001 and prior, Series A, all versions, MicroLogix 1100 Controller, all versionsRockwell Automation MicroLogix 1400 Controllers Series B v2…
- CVE-2020-6990Rockwell Automation MicroLogix 1400 Controllers Series B v21.001 and prior, Series A, all versions, MicroLogix 1100 Controller, all versionsRockwell Automation MicroLogix 1400 Controllers Series B v2…
High 3
- CVE-2020-5849Unraid 6.8.0 allows authentication bypass.
- CVE-2020-6988Rockwell Automation MicroLogix 1400 Controllers Series B v21.001 and prior, Series A, all versions, MicroLogix 1100 Controller, all versionsRockwell Automation MicroLogix 1400 Controllers Series B v2…
- CVE-2019-14887A flaw was found when an OpenSSL security provider is used with Wildfly, the 'enabled-protocols' value in the Wildfly configuration isn't hoRed Hat wildfly
Medium, low and unrated 83
- CVE-2020-9347Zoho ManageEngine Password Manager Pro through 10.x has a CSV Excel Macro Injection vulnerability via a crafted name that is mishandled by t
- CVE-2020-9346Zoho ManageEngine Password Manager Pro 10.4 and prior has no protection against Cross-site Request Forgery (CSRF) attacks, as demonstrated b
- CVE-2019-20191Oxygen XML Editor 21.1.1 allows XXE to read any file.
- CVE-2020-8784SuiteCRM 7.10.x versions prior to 7.10.23 and 7.11.x versions prior to 7.11.11 allow SQL Injection (issue 2 of 4).
- CVE-2020-8785SuiteCRM 7.10.x versions prior to 7.10.23 and 7.11.x versions prior to 7.11.11 allow SQL Injection (issue 3 of 4).
- CVE-2020-8786SuiteCRM 7.10.x versions prior to 7.10.23 and 7.11.x versions prior to 7.11.11 allow SQL Injection (issue 4 of 4).
- CVE-2020-8787SuiteCRM 7.10.x versions prior to 7.10.23 and 7.11.x versions prior to 7.11.11 allow for an invalid Bean ID to be submitted.
- CVE-2019-20326A heap-based buffer overflow in _cairo_image_surface_create_from_jpeg() in extensions/cairo_io/cairo-image-surface-jpeg.c in GNOME gThumb be
- CVE-2020-8783SuiteCRM 7.10.x versions prior to 7.10.23 and 7.11.x versions prior to 7.11.11 allow SQL Injection (issue 1 of 4).
- CVE-2020-7982An issue was discovered in OpenWrt 18.06.0 to 18.06.6 and 19.07.0, and LEDE 17.01.0 to 17.01.7.
- CVE-2020-7919Go before 1.12.16 and 1.13.x before 1.13.7 (and the crypto/cryptobyte package before 0.0.0-20200124225646-8b5121be2f68 for Go) allows attackgithub.com/helm/helm · helm.sh/helm/v3 +2
- CVE-2020-7248libubox in OpenWrt before 18.06.7 and 19.x before 19.07.1 has a tagged binary data JSON serialization vulnerability that may cause a stack b
- CVE-2020-6175Citrix SD-WAN 10.2.x before 10.2.6 and 11.0.x before 11.0.3 has Missing SSL Certificate Validation.
- CVE-2019-19852An XSS Injection vulnerability exists in Sangoma FreePBX and PBXact 13, 14, and 15 within the Call Event Logging report screen in the cel mo
- CVE-2019-19615Multiple XSS vulnerabilities exist in the Backup & Restore module \ v14.0.10.2 through v14.0.10.7 for FreePBX, as shown at /admin/config.php
- CVE-2019-19613An issue was discovered in Halvotec RaQuest 10.23.10801.0.
- CVE-2019-19612An issue was discovered in Halvotec RaQuest 10.23.10801.0.
- CVE-2019-19610An issue was discovered in Halvotec RaQuest 10.23.10801.0.
- CVE-2019-20491cPanel before 82.0.18 allows attackers to leverage virtual mail accounts in order to bypass account suspensions (SEC-508).
- CVE-2019-19538In Sangoma FreePBX 13 through 15 and sysadmin (aka System Admin) 13.0.92 through 15.0.13.6 modules have a Remote Command Execution vulnerabi
- CVE-2019-19461Post-authentication Stored XSS in Team Password Manager through 7.93.204 allows attackers to steal other users' credentials by creating a sh
- CVE-2019-18917A potential security vulnerability has been identified for certain HP Printers and All-in-Ones that would allow bypassing account lockout.HP ENVY 5000 All-in-One Printer series (M2U85A - M2U85B, M2…
- CVE-2020-7608yargs-parser could be tricked into adding or modifying properties of Object.prototype using a "__proto__" payload.yargs-parser
- CVE-2019-19212Dolibarr ERP/CRM 3.0 through 10.0.3 allows XSS via the qty parameter to product/fournisseurs.php (product price screen).dolibarr/dolibarr
- CVE-2020-9472Umbraco CMS 8.5.3 allows an authenticated file upload (and consequently Remote Code Execution) via the Install Package functionality.UmbracoCms
- CVE-2019-19937In JFrog Artifactory before 6.18, it is not possible to restrict either system or repository imports by any admin user in the enterprise, wh
- CVE-2020-9471Umbraco Cloud 8.5.3 allows an authenticated file upload (and consequently Remote Code Execution) via the Install Packages functionality.UmbracoCMS.Core
- CVE-2017-12842Bitcoin Core before 0.14 allows an attacker to create an ostensibly valid SPV proof for a payment to a victim who uses an SPV wallet, even i
- CVE-2019-11073A Remote Code Execution vulnerability exists in PRTG Network Monitor before 19.4.54.1506 that allows attackers to execute code due to insuff
- CVE-2020-9321configurationwatcher.go in Traefik 2.x before 2.1.4 and TraefikEE 2.0.0 mishandles the purging of certificate contents from providers beforegithub.com/containous/traefik · github.com/containous/tr… +1
- CVE-2019-19946The API in Dradis Pro 3.4.1 allows any user to extract the content of a project, even if this user is not part of the project team.
- CVE-2019-5543For VMware Horizon Client for Windows (5.x and prior before 5.3.0), VMware Remote Console for Windows (10.x before 11.0.0), VMware WorkstatiVMware Horizon Client for Windows · VMware Remote Consol… +1
- CVE-2020-5844index.php?sec=godmode/extensions&sec2=extensions/files_repo in Pandora FMS v7.0 NG allows authenticated administrators to upload malicious P
- CVE-2020-3947VMware Workstation (15.x before 15.5.2) and Fusion (11.x before 11.5.2) contain a use-after vulnerability in vmnetdhcp.VMware Workstation · VMware Fusion
- CVE-2020-3948Linux Guest VMs running on VMware Workstation (15.x before 15.5.2) and Fusion (11.x before 11.5.2) contain a local privilege escalation vulnVMware Workstation · VMware Fusion
- CVE-2019-19945uhttpd in OpenWrt through 18.06.5 and 19.x through 19.07.0-rc2 has an integer signedness error.
- CVE-2019-19821A post-authentication privilege escalation in the web application of Combodo iTop allows regular authenticated users to access information a
- CVE-2020-6582Nagios NRPE 3.2.1 has a Heap-Based Buffer Overflow, as demonstrated by interpretation of a small negative number as a large positive number
- CVE-2020-6581Nagios NRPE 3.2.1 has Insufficient Filtering because, for example, nasty_metachars interprets \n as the character \ and the character n (not
- CVE-2020-7916be_teacher in class-lp-admin-ajax.php in the LearnPress plugin 3.2.6.5 and earlier for WordPress allows any registered user to assign itself
- CVE-2020-10243An issue was discovered in Joomla! before 3.9.16.
- CVE-2020-10242An issue was discovered in Joomla! before 3.9.16.
- CVE-2020-10241An issue was discovered in Joomla! before 3.9.16.
- CVE-2019-19135In OPC Foundation OPC UA .NET Standard codebase 1.4.357.28, servers do not create sufficiently random numbers in OPCFoundation.NetStandard.Oorg.eclipse.milo:sdk-client
- CVE-2020-10240An issue was discovered in Joomla! before 3.9.16.
- CVE-2020-10239An issue was discovered in Joomla! before 3.9.16.
- CVE-2020-10238An issue was discovered in Joomla! before 3.9.16.
- CVE-2020-6980Rockwell Automation MicroLogix 1400 Controllers Series B v21.001 and prior, Series A, all versions, MicroLogix 1100 Controller, all versionsRockwell Automation MicroLogix 1400 Controllers Series B v2…
- CVE-2020-10230CentOS-WebPanel.com (aka CWP) CentOS Web Panel (for CentOS 6 and 7) allows SQL Injection via the /cwp_{SESSION_HASH}/admin/loader_ajax.php t
- CVE-2020-6584Nagios Log Server 2.1.3 has Incorrect Access Control.
- CVE-2020-6585Nagios Log Server 2.1.3 has CSRF.
- CVE-2020-6586Nagios Log Server 2.1.3 allows XSS by visiting /profile and entering a crafted name field that is mishandled on the /admin/users page.
- CVE-2019-4719IBM MQ and IBM MQ Appliance 7.1, 7.5, 8.0, 9.0 LTS, 9.1 LTS, and 9.1 CD could allow a local attacker to obtain sensitive information by inclIBM MQ
- CVE-2019-4656IBM MQ and IBM MQ Appliance 7.1, 7.5, 8.0, 9.0 LTS, 9.1 LTS, and 9.1 CD is vulnerable to a denial of service attack that would allow an authIBM MQ
- CVE-2019-4619IBM MQ and IBM MQ Appliance 7.1, 7.5, 8.0, 9.0 LTS, 9.1 LTS, and 9.1 CD could allow a local attacker to obtain sensitive information by inclIBM MQ
- CVE-2019-4617IBM Cloud Automation Manager 3.2.1.0 does not renew a session variable after a successful authentication which could lead to session fixatioIBM Cloud Automation Manager
- CVE-2019-19942Missing output sanitation in Swisscom Centro Grande Centro Grande before 6.16.12, Centro Business 1.0 (ADB) before 7.10.18, and Centro Busin
- CVE-2019-19941Missing hostname validation in Swisscom Centro Grande before 6.16.12 allows a remote attacker to inject its local IP address as a domain ent
- CVE-2019-19940Incorrect input sanitation in text-oriented user interfaces (telnet, ssh) in Swisscom Centro Grande before 6.16.12 allows remote authenticat
- CVE-2020-1738A flaw was found in Ansible Engine when the module package or service is used and the parameter 'use' is not specified.Red Hat ansible · ansible
- CVE-2019-19851An XSS Injection vulnerability exists in Sangoma FreePBX and PBXact 13, 14, and 15 within the Debug/Test page of the Superfecta module at th
- CVE-2020-1740A flaw was found in Ansible Engine when using Ansible Vault for editing encrypted files.Red Hat ansible · ansible
- CVE-2020-1735A flaw was found in the Ansible Engine when the fetch module is used.Red Hat ansible · ansible
- CVE-2020-1736A flaw was found in Ansible Engine when a file is moved using atomic_move primitive as the file mode cannot be specified.Red Hat ansible · ansible
- CVE-2019-19211Dolibarr ERP/CRM before 10.0.3 has an Insufficient Filtering issue that can lead to user/card.php XSS.dolibarr/dolibarr
- CVE-2019-19210Dolibarr ERP/CRM before 10.0.3 allows XSS because uploaded HTML documents are served as text/html despite being renamed to .noexe files.dolibarr/dolibarr
- CVE-2019-19209Dolibarr ERP/CRM before 10.0.3 allows SQL Injection.dolibarr/dolibarr
- CVE-2019-19208Codiad Web IDE through 2.8.4 allows PHP Code injection.codiad/codiad
- CVE-2019-14512LimeSurvey 3.17.7+190627 has XSS via Boxes in application/extensions/PanelBoxWidget/views/box.php or a label title in application/views/admi
- CVE-2018-10125Contao before 4.5.7 has XSS in the system log.contao/contao · contao/core-bundle +1
- CVE-2020-1753A security flaw was found in Ansible Engine, all Ansible 2.7.x versions prior to 2.7.17, all Ansible 2.8.x versions prior to 2.8.11 and all Red Hat Ansible · ansible
- CVE-2018-13063Easy!Appointments 1.3.0 has a Missing Authorization issue allowing retrieval of hashed passwords and salts.
- CVE-2018-13060Easy!Appointments 1.3.0 has a Guessable CAPTCHA issue.
- CVE-2020-10557An issue was discovered in AContent through 1.4.
- CVE-2019-10091When TLS is enabled with ssl-endpoint-identification-enabled set to true, Apache Geode fails to perform hostname verification of the entriesApache Geode · org.apache.geode:geode-core
- CVE-2020-9518Login filter can access configuration files vulnerability in Micro Focus Service Manager (Web Tier), affecting versions 9.50, 9.51, 9.52, 9.Micro Focus International Service Manager (Web Tier).
- CVE-2020-9519HTTP methods reveled in Web services vulnerability in Micro Focus Service manager (server), affecting versions 9.40, 9.41, 9.50, 9.51, 9.52,Micro Focus International Service Manager (Server).
- CVE-2020-5547Resource Management Errors vulnerability in TCP function included in the firmware of Mitsubishi Electric MELQIC IU1 series IU1-1M20-D firmwaMitsubishi Electric MELQIC IU1 series
- CVE-2020-5545TCP function included in the firmware of Mitsubishi Electric MELQIC IU1 series IU1-1M20-D firmware version 1.0.7 and earlier allows remote aMitsubishi Electric MELQIC IU1 series
- CVE-2020-5546Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability in TCP function included in the firmware ofMitsubishi Electric MELQIC IU1 series
- CVE-2020-5543TCP function included in the firmware of Mitsubishi Electric MELQIC IU1 series IU1-1M20-D firmware version 1.0.7 and earlier does not properMitsubishi Electric MELQIC IU1 series
- CVE-2020-5544Null Pointer Dereference vulnerability in TCP function included in the firmware of Mitsubishi Electric MELQIC IU1 series IU1-1M20-D firmwareMitsubishi Electric MELQIC IU1 series
- CVE-2020-5542Buffer error vulnerability in TCP function included in the firmware of Mitsubishi Electric MELQIC IU1 series IU1-1M20-D firmware version 1.0Mitsubishi Electric MELQIC IU1 series