CVEs published March 17, 2020
31 CVEs were published on March 17, 2020: 0 critical, 1 high. 1 is now in CISA KEV.
- Published
- 31
- Critical
- 0
- High
- 1
- Medium
- 0
- Low
- 1
- Unrated
- 29
- Now in CISA KEV
- 1
- Fix available
- 3
Most affected products
- Atlassian Application Links · Atlassian Jira Server and Dat…
- 1
- Atlassian Jira Software
- 1
- Fortinet FortiWeb
- 1
- intelliants/subrion
- 1
- opencart/opencart
- 1
- Red Hat postgresql
- 1
- VMware Fusion, VMware Remote Console for Mac and Horizon Cl…
- 1
- VMware Workstation and Horizon Client for Windows
- 1
High 1
Medium, low and unrated 30
- CVE-2020-3951VMware Workstation (15.x before 15.5.2) and Horizon Client for Windows (5.x and prior before 5.4.0) contain a denial-of-service vulnerabilitVMware Workstation and Horizon Client for Windows
- CVE-2020-1720A flaw was found in PostgreSQL's "ALTER ...Red Hat postgresql
- CVE-2018-21037Subrion CMS 4.1.5 (and possibly earlier versions) allow CSRF to change the administrator password via the panel/members/edit/1 URI.intelliants/subrion
- CVE-2020-10596OpenCart 3.0.3.2 allows remote authenticated users to conduct XSS attacks via a crafted filename in the users' image upload section.opencart/opencart
- CVE-2020-10122cPanel before 84.0.20 allows a webmail or demo account to delete arbitrary files (SEC-547).
- CVE-2020-10121cPanel before 84.0.20 allows a demo account to achieve code execution via PassengerApps APIs (SEC-546).
- CVE-2020-10120cPanel before 84.0.20 allows resellers to achieve remote code execution as root via a cpsrvd rsync shell (SEC-545).
- CVE-2020-10119cPanel before 84.0.20 allows a demo account to achieve remote code execution via a cpsrvd rsync shell (SEC-544).
- CVE-2020-10118cPanel before 84.0.20 allows a demo account to modify files via Branding API calls (SEC-543).
- CVE-2020-10117cPanel before 84.0.20 mishandles enforcement of demo checks in the Market UAPI namespace (SEC-542).
- CVE-2020-10116cPanel before 84.0.20 allows attackers to bypass intended restrictions on features and demo accounts via WebDisk UAPI calls (SEC-541).
- CVE-2020-10115cPanel before 84.0.20, when PowerDNS is used, allows arbitrary code execution as root via dnsadmin.
- CVE-2020-10114cPanel before 84.0.20 allows stored self-XSS via the HTML file editor (SEC-535).
- CVE-2020-10113cPanel before 84.0.20 allows self XSS via a temporary character-set specification (SEC-515).
- CVE-2019-20498cPanel before 82.0.18 allows WebDAV authentication bypass because the connection-sharing logic is incorrect (SEC-534).
- CVE-2019-20497cPanel before 82.0.18 allows stored XSS via WHM Backup Restoration (SEC-533).
- CVE-2019-20496cPanel before 82.0.18 allows attackers to conduct arbitrary chown operations as root during log processing (SEC-532).
- CVE-2019-20495cPanel before 82.0.18 allows attackers to read an arbitrary database via MySQL dump streaming (SEC-531).
- CVE-2019-20494In cPanel before 82.0.18, Cpanel::Rand::Get can produce a predictable series of numbers (SEC-525).
- CVE-2019-20493cPanel before 82.0.18 allows self-XSS because JSON string escaping is mishandled (SEC-520).
- CVE-2019-20492cPanel before 82.0.18 allows authentication bypass because of misparsing of the format of the password file (SEC-516).
- CVE-2019-20490cPanel before 82.0.18 allows authentication bypass because webmail usernames are processed inconsistently (SEC-499).
- CVE-2018-18576The Hustle (aka wordpress-popup) plugin through 6.0.5 for WordPress allows Directory Traversal to obtain a directory listing via the views/a
- CVE-2019-11074A Write to Arbitrary Location in Disk vulnerability exists in PRTG Network Monitor 19.1.49 and below that allows attackers to place files in
- CVE-2020-10380RMySQL through 0.10.19 allows SQL Injection.
- CVE-2019-20453A problem was found in Pydio Core before 8.2.4 and Pydio Enterprise before 8.2.4.
- CVE-2019-20452A problem was found in Pydio Core before 8.2.4 and Pydio Enterprise before 8.2.4.
- CVE-2020-6646An improper neutralization of input vulnerability in FortiWeb allows a remote authenticated attacker to perform a stored cross site scriptinFortinet FortiWeb
- CVE-2019-20407The ConfigureBambooRelease resource in Jira Software and Jira Software Data Center before version 8.6.1 allows authenticated remote attackerAtlassian Jira Software
- CVE-2019-20105The EditApplinkServlet resource in the Atlassian Application Links plugin before version 5.4.20, from version 6.0.0 before version 6.0.12, fAtlassian Application Links · Atlassian Jira Server and Dat…