# CVEs published 2020-03-17

31 CVEs were published on March 17, 2020: 0 critical, 1 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2020-3950](https://cve.now/CVE-2020-3950.md): VMware Fusion (11.x before 11.5.2), VMware Remote Console for Mac (11.x and prior before 11.0.1) and Horizon Client for Mac (5.x and prior b (CVSS 7.8, KEV, VMware Fusion, VMware Remote Console for Mac and Horizon Cl…)
- [CVE-2020-3951](https://cve.now/CVE-2020-3951.md): VMware Workstation (15.x before 15.5.2) and Horizon Client for Windows (5.x and prior before 5.4.0) contain a denial-of-service vulnerabilit (no CVSS, VMware Workstation and Horizon Client for Windows)
- [CVE-2020-1720](https://cve.now/CVE-2020-1720.md): A flaw was found in PostgreSQL's "ALTER ... (CVSS 3.1, Red Hat postgresql)
- [CVE-2018-21037](https://cve.now/CVE-2018-21037.md): Subrion CMS 4.1.5 (and possibly earlier versions) allow CSRF to change the administrator password via the panel/members/edit/1 URI. (no CVSS, intelliants/subrion)
- [CVE-2020-10596](https://cve.now/CVE-2020-10596.md): OpenCart 3.0.3.2 allows remote authenticated users to conduct XSS attacks via a crafted filename in the users' image upload section. (no CVSS, opencart/opencart)
- [CVE-2020-10122](https://cve.now/CVE-2020-10122.md): cPanel before 84.0.20 allows a webmail or demo account to delete arbitrary files (SEC-547). (no CVSS)
- [CVE-2020-10121](https://cve.now/CVE-2020-10121.md): cPanel before 84.0.20 allows a demo account to achieve code execution via PassengerApps APIs (SEC-546). (no CVSS)
- [CVE-2020-10120](https://cve.now/CVE-2020-10120.md): cPanel before 84.0.20 allows resellers to achieve remote code execution as root via a cpsrvd rsync shell (SEC-545). (no CVSS)
- [CVE-2020-10119](https://cve.now/CVE-2020-10119.md): cPanel before 84.0.20 allows a demo account to achieve remote code execution via a cpsrvd rsync shell (SEC-544). (no CVSS)
- [CVE-2020-10118](https://cve.now/CVE-2020-10118.md): cPanel before 84.0.20 allows a demo account to modify files via Branding API calls (SEC-543). (no CVSS)
- [CVE-2020-10117](https://cve.now/CVE-2020-10117.md): cPanel before 84.0.20 mishandles enforcement of demo checks in the Market UAPI namespace (SEC-542). (no CVSS)
- [CVE-2020-10116](https://cve.now/CVE-2020-10116.md): cPanel before 84.0.20 allows attackers to bypass intended restrictions on features and demo accounts via WebDisk UAPI calls (SEC-541). (no CVSS)
- [CVE-2020-10115](https://cve.now/CVE-2020-10115.md): cPanel before 84.0.20, when PowerDNS is used, allows arbitrary code execution as root via dnsadmin. (no CVSS)
- [CVE-2020-10114](https://cve.now/CVE-2020-10114.md): cPanel before 84.0.20 allows stored self-XSS via the HTML file editor (SEC-535). (no CVSS)
- [CVE-2020-10113](https://cve.now/CVE-2020-10113.md): cPanel before 84.0.20 allows self XSS via a temporary character-set specification (SEC-515). (no CVSS)
- [CVE-2019-20498](https://cve.now/CVE-2019-20498.md): cPanel before 82.0.18 allows WebDAV authentication bypass because the connection-sharing logic is incorrect (SEC-534). (no CVSS)
- [CVE-2019-20497](https://cve.now/CVE-2019-20497.md): cPanel before 82.0.18 allows stored XSS via WHM Backup Restoration (SEC-533). (no CVSS)
- [CVE-2019-20496](https://cve.now/CVE-2019-20496.md): cPanel before 82.0.18 allows attackers to conduct arbitrary chown operations as root during log processing (SEC-532). (no CVSS)
- [CVE-2019-20495](https://cve.now/CVE-2019-20495.md): cPanel before 82.0.18 allows attackers to read an arbitrary database via MySQL dump streaming (SEC-531). (no CVSS)
- [CVE-2019-20494](https://cve.now/CVE-2019-20494.md): In cPanel before 82.0.18, Cpanel::Rand::Get can produce a predictable series of numbers (SEC-525). (no CVSS)
- [CVE-2019-20493](https://cve.now/CVE-2019-20493.md): cPanel before 82.0.18 allows self-XSS because JSON string escaping is mishandled (SEC-520). (no CVSS)
- [CVE-2019-20492](https://cve.now/CVE-2019-20492.md): cPanel before 82.0.18 allows authentication bypass because of misparsing of the format of the password file (SEC-516). (no CVSS)
- [CVE-2019-20490](https://cve.now/CVE-2019-20490.md): cPanel before 82.0.18 allows authentication bypass because webmail usernames are processed inconsistently (SEC-499). (no CVSS)
- [CVE-2018-18576](https://cve.now/CVE-2018-18576.md): The Hustle (aka wordpress-popup) plugin through 6.0.5 for WordPress allows Directory Traversal to obtain a directory listing via the views/a (no CVSS)
- [CVE-2019-11074](https://cve.now/CVE-2019-11074.md): A Write to Arbitrary Location in Disk vulnerability exists in PRTG Network Monitor 19.1.49 and below that allows attackers to place files in (no CVSS)
- [CVE-2020-10380](https://cve.now/CVE-2020-10380.md): RMySQL through 0.10.19 allows SQL Injection. (no CVSS)
- [CVE-2019-20453](https://cve.now/CVE-2019-20453.md): A problem was found in Pydio Core before 8.2.4 and Pydio Enterprise before 8.2.4. (no CVSS)
- [CVE-2019-20452](https://cve.now/CVE-2019-20452.md): A problem was found in Pydio Core before 8.2.4 and Pydio Enterprise before 8.2.4. (no CVSS)
- [CVE-2020-6646](https://cve.now/CVE-2020-6646.md): An improper neutralization of input vulnerability in FortiWeb allows a remote authenticated attacker to perform a stored cross site scriptin (no CVSS, Fortinet FortiWeb)
- [CVE-2019-20407](https://cve.now/CVE-2019-20407.md): The ConfigureBambooRelease resource in Jira Software and Jira Software Data Center before version 8.6.1 allows authenticated remote attacker (no CVSS, Atlassian Jira Software)
- [CVE-2019-20105](https://cve.now/CVE-2019-20105.md): The EditApplinkServlet resource in the Atlassian Application Links plugin before version 5.4.20, from version 6.0.0 before version 6.0.12, f (no CVSS, Atlassian Application Links · Atlassian Jira Server and Dat…)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2020-03-17
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.