CVEs published March 18, 2020
71 CVEs were published on March 18, 2020: 4 critical, 7 high. 3 are now in CISA KEV.
- Published
- 71
- Critical
- 4
- High
- 7
- Medium
- 10
- Low
- 2
- Unrated
- 48
- Now in CISA KEV
- 3
- Fix available
- 12
Most affected products
- [UNKNOWN] moodle · moodle/moodle
- 4
- Trend Micro OfficeScan, Trend Micro Apex One, Trend Micro W…
- 3
- com.fasterxml.jackson.core:jackson-databind
- 2
- Dell Data Protection Advisor
- 2
- Delta Industrial Automation CNCSoft ScreenEditor
- 2
- McAfee Network Security Management
- 2
- Red Hat openshift
- 2
- Trend Micro OfficeScan, Trend Micro Apex One
- 2
- ArmorX LisoMail
- 1
- Dell Data Protection Central
- 1
Critical 4
- CVE-2019-18582Dell EMC Data Protection Advisor versions 6.3, 6.4, 6.5, 18.2 versions prior to patch 83, and 19.1 versions prior to patch 71 contain a servDell Data Protection Advisor
- CVE-2019-18581Dell EMC Data Protection Advisor versions 6.3, 6.4, 6.5, 18.2 versions prior to patch 83, and 19.1 versions prior to patch 71 contain a servDell Data Protection Advisor
- CVE-2020-3922ArmorX LisoMail - SQL InjectionArmorX LisoMail
- CVE-2020-8599Trend Micro Apex One (2019) and OfficeScan XG server contain a vulnerable EXE file that could allow a remote attacker to write arbitrary datTrend Micro OfficeScan, Trend Micro Apex One
High 7
- CVE-2020-10672FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.arcom.fasterxml.jackson.core:jackson-databind
- CVE-2020-10673FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to com.caucho.cocom.fasterxml.jackson.core:jackson-databind
- CVE-2019-3762Data Protection Central versions 1.0, 1.0.1, 18.1, 18.2, and 19.1 contains an Improper Certificate Chain of Trust Vulnerability.Dell Data Protection Central
- CVE-2019-19355An insecure modification vulnerability in the /etc/passwd file was found in the openshift/ocp-release-operator-sdk.Red Hat openshift
- CVE-2019-19351An insecure modification vulnerability in the /etc/passwd file was found in the container openshift/jenkins.Red Hat openshift
- CVE-2020-8467A migration tool component of Trend Micro Apex One (2019) and OfficeScan XG contains a vulnerability which could allow remote attackers to eTrend Micro OfficeScan, Trend Micro Apex One
- CVE-2020-8468Trend Micro Apex One (2019), OfficeScan XG and Worry-Free Business Security (9.0, 9.5, 10.0) agents are affected by a content validation escTrend Micro OfficeScan, Trend Micro Apex One, Trend Micro W…
Medium, low and unrated 60
- CVE-2019-19677arxes-tolina 3.0.0 allows User Enumeration.
- CVE-2019-19676A CSV injection in arxes-tolina 3.0.0 allows malicious users to gain remote control of other computers.
- CVE-2020-10674PerlSpeak through 2.01 allows attackers to execute arbitrary OS commands, as demonstrated by use of system and 2-argument open.
- CVE-2020-10365LogicalDoc before 8.3.3 allows SQL Injection.
- CVE-2020-7256Network Security Management (NSM) - Cross site scripting vulnerabilityMcAfee Network Security Management
- CVE-2020-7258Network Security Management (NSM) - Cross site scripting vulnerabilityMcAfee Network Security Management
- CVE-2020-9423LogicalDoc before 8.3.3 could allow an attacker to upload arbitrary files, leading to command execution or retrieval of data from the databa
- CVE-2019-18979Adaware antivirus 12.6.1005.11662 and 12.7.1055.0 has a quarantine flaw that allows privilege escalation.
- CVE-2020-10665Docker Desktop allows local privilege escalation to NT AUTHORITY\SYSTEM because it mishandles the collection of diagnostics with Administrat
- CVE-2019-20528Ignite Realtime Openfire 4.4.1 allows XSS via the setup/setup-datasource-standard.jsp username parameter.org.igniterealtime.openfire:xmppserver
- CVE-2019-20512Open edX Ironwood.1 allows support/certificates?course_id= reflected XSS.
- CVE-2019-20511ERPNext 11.1.47 allows blog?blog_category= Frame Injection.
- CVE-2019-12921In GraphicsMagick before 1.3.32, the text filename component allows remote attackers to read arbitrary files via a crafted image because of
- CVE-2019-12769SolarWinds Serv-U Managed File Transfer (MFT) Web client before 15.1.6 Hotfix 2 is vulnerable to Cross-Site Request Forgery in the file uplo
- CVE-2019-12370The Spark application through 2.0.2 for Android allows XSS via an event attribute and arbitrary file loading via a src attribute, if the app
- CVE-2019-12369The TypeApp application through 1.9.5.35 for Android allows XSS via an event attribute and arbitrary file loading via a src attribute, if th
- CVE-2019-12368The Edison Mail application through 1.7.1 for Android allows XSS via an event attribute and arbitrary file loading via a src attribute, if t
- CVE-2019-12367The BlueMail application through 1.9.5.36 for Android allows XSS via an event attribute and arbitrary file loading via a src attribute, if t
- CVE-2019-20529In core/doctype/prepared_report/prepared_report.py in Frappe 11 and 12, data files generated with Prepared Report were being stored as publi
- CVE-2019-12366The Nine application through 4.5.3a for Android allows XSS via an event attribute and arbitrary file loading via a src attribute, if the app
- CVE-2019-12365The Newton application through 10.0.23 for Android allows XSS via an event attribute and arbitrary file loading via a src attribute, if the
- CVE-2019-12131An issue was detected in ONAP APPC through Dublin and SDC through Dublin.
- CVE-2019-12132An issue was discovered in ONAP SDNC before Dublin.
- CVE-2019-12124An issue was discovered in ONAP APPC before Dublin.
- CVE-2019-12123An issue was discovered in ONAP SDNC before Dublin.
- CVE-2019-12122An issue was discovered in ONAP Portal through Dublin.
- CVE-2019-12121An issue was detected in ONAP Portal through Dublin.
- CVE-2019-12120An issue was discovered in ONAP VNFSDK through Dublin.
- CVE-2019-12119An issue was discovered in ONAP SDC through Dublin.
- CVE-2019-12118An issue was discovered in ONAP SDC through Dublin.
- CVE-2019-12117An issue was discovered in ONAP SDC through Dublin.
- CVE-2019-12116An issue was discovered in ONAP SDC through Dublin.
- CVE-2019-12115An issue was discovered in ONAP SDC through Dublin.
- CVE-2019-12114An issue was discovered in ONAP HOLMES before Dublin.
- CVE-2019-12113An issue was discovered in ONAP SDNC before Dublin.
- CVE-2019-12112An issue was discovered in ONAP SDNC before Dublin.
- CVE-2019-19335During installation of an OpenShift 4 cluster, the `openshift-install` command line tool creates an `auth` directory, with `kubeconfig` and Red Hat openshift/installer
- CVE-2019-14871The REENT_CHECK macro (see newlib/libc/include/sys/reent.h) as used by REENT_CHECK_TM, REENT_CHECK_MISC, REENT_CHECK_MP and other newlib macRed Hat newlib
- CVE-2019-10682django-nopassword before 5.0.0 stores cleartext secrets in the database.django-nopassword
- CVE-2019-11689An issue was discovered in ASUSTOR exFAT Driver through 1.0.0.r20.
- CVE-2019-11688An issue was discovered in ASUSTOR exFAT Driver through 1.0.0.r20.
- CVE-2019-10178It was found that the Token Processing Service (TPS) did not properly sanitize the Token IDs from the "Activity" page, enabling a Stored CroThe pki-core Project pki-core
- CVE-2019-10146A Reflected Cross Site Scripting flaw was found in all pki-core 10.x.x versions module from the pki-core server due to the CA Agent Service Red Hat pki-core
- CVE-2020-9326BeyondTrust Privilege Management for Windows and Mac (aka PMWM; formerly Avecto Defendpoint) 5.1 through 5.5 before 5.5 SR1 mishandles comma
- CVE-2020-4199IBM Tivoli Netcool/OMNIbus 8.1.0 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorIBM Tivoli Netcool/OMNIbus
- CVE-2020-9325Aquaforest TIFF Server 4.0 allows Unauthenticated Arbitrary File Download.
- CVE-2020-9324Aquaforest TIFF Server 4.0 allows Unauthenticated SMB Hash Capture via UNC.
- CVE-2020-9323Aquaforest TIFF Server 4.0 allows Unauthenticated File and Directory Enumeration via tiffserver/tssp.aspx.
- CVE-2020-6976Delta Industrial Automation CNCSoft ScreenEditor, v1.00.96 and prior.Delta Industrial Automation CNCSoft ScreenEditor
- CVE-2020-7002Delta Industrial Automation CNCSoft ScreenEditor, v1.00.96 and prior.Delta Industrial Automation CNCSoft ScreenEditor
- CVE-2020-9443Zulip Desktop before 4.0.3 loaded untrusted content in an Electron webview with web security disabled, which can be exploited for XSS in a n
- CVE-2019-14881A vulnerability was found in moodle 3.7 before 3.7.3, where there is blind XSS reflected in some locations where user email is displayed.[UNKNOWN] moodle · moodle/moodle
- CVE-2019-14884A vulnerability was found in Moodle 3.7 before 3.73, 3.6 before 3.6.7 and 3.5 before 3.5.9, where a reflected XSS possible from some fatal e[UNKNOWN] moodle · moodle/moodle
- CVE-2019-14883A vulnerability was found in Moodle 3.6 before 3.6.7 and 3.7 before 3.7.3, where tokens used to fetch inline atachments in email notificatio[UNKNOWN] moodle · moodle/moodle
- CVE-2019-14882A vulnerability was found in Moodle 3.7 to 3.7.3, 3.6 to 3.6.7, 3.5 to 3.5.9 and earlier where an open redirect existed in the Lesson edit p[UNKNOWN] moodle · moodle/moodle
- CVE-2020-10659Entrust Entelligence Security Provider (ESP) before 10.0.60 on Windows mishandles errors during SSL Certificate Validation, leading to situa
- CVE-2019-11939Golang Facebook Thrift servers would not error upon receiving messages declaring containers of sizes larger than the payload.Facebook Thrift · github.com/facebook/fbthrift
- CVE-2020-8600Trend Micro Worry-Free Business Security (9.0, 9.5, 10.0) is affected by a directory traversal vulnerability that could allow an attacker toTrend Micro Worry-Free Business Security
- CVE-2020-8470Trend Micro Apex One (2019), OfficeScan XG and Worry-Free Business Security (9.0, 9.5, 10.0) server contains a vulnerable service DLL file tTrend Micro OfficeScan, Trend Micro Apex One, Trend Micro W…
- CVE-2020-8598Trend Micro Apex One (2019), OfficeScan XG and Worry-Free Business Security (9.0, 9.5, 10.0) server contains a vulnerable service DLL file tTrend Micro OfficeScan, Trend Micro Apex One, Trend Micro W…