# CVEs published 2020-03-18

71 CVEs were published on March 18, 2020: 4 critical, 7 high. 3 are now in CISA KEV. Days are UTC.

- [CVE-2019-19677](https://cve.now/CVE-2019-19677.md): arxes-tolina 3.0.0 allows User Enumeration. (no CVSS)
- [CVE-2019-19676](https://cve.now/CVE-2019-19676.md): A CSV injection in arxes-tolina 3.0.0 allows malicious users to gain remote control of other computers. (no CVSS)
- [CVE-2020-10674](https://cve.now/CVE-2020-10674.md): PerlSpeak through 2.01 allows attackers to execute arbitrary OS commands, as demonstrated by use of system and 2-argument open. (no CVSS)
- [CVE-2020-10365](https://cve.now/CVE-2020-10365.md): LogicalDoc before 8.3.3 allows SQL Injection. (no CVSS)
- [CVE-2020-10672](https://cve.now/CVE-2020-10672.md): FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.ar (CVSS 8.8, com.fasterxml.jackson.core:jackson-databind)
- [CVE-2020-10673](https://cve.now/CVE-2020-10673.md): FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to com.caucho.co (CVSS 8.8, com.fasterxml.jackson.core:jackson-databind)
- [CVE-2020-7256](https://cve.now/CVE-2020-7256.md): Network Security Management (NSM) - Cross site scripting vulnerability (CVSS 4.8, McAfee Network Security Management)
- [CVE-2020-7258](https://cve.now/CVE-2020-7258.md): Network Security Management (NSM) - Cross site scripting vulnerability (CVSS 4.8, McAfee Network Security Management)
- [CVE-2020-9423](https://cve.now/CVE-2020-9423.md): LogicalDoc before 8.3.3 could allow an attacker to upload arbitrary files, leading to command execution or retrieval of data from the databa (no CVSS)
- [CVE-2019-18979](https://cve.now/CVE-2019-18979.md): Adaware antivirus 12.6.1005.11662 and 12.7.1055.0 has a quarantine flaw that allows privilege escalation. (no CVSS)
- [CVE-2020-10665](https://cve.now/CVE-2020-10665.md): Docker Desktop allows local privilege escalation to NT AUTHORITY\\SYSTEM because it mishandles the collection of diagnostics with Administrat (no CVSS)
- [CVE-2019-20528](https://cve.now/CVE-2019-20528.md): Ignite Realtime Openfire 4.4.1 allows XSS via the setup/setup-datasource-standard.jsp username parameter. (no CVSS, org.igniterealtime.openfire:xmppserver)
- [CVE-2019-3762](https://cve.now/CVE-2019-3762.md): Data Protection Central versions 1.0, 1.0.1, 18.1, 18.2, and 19.1 contains an Improper Certificate Chain of Trust Vulnerability. (CVSS 7.5, Dell Data Protection Central)
- [CVE-2019-18582](https://cve.now/CVE-2019-18582.md): Dell EMC Data Protection Advisor versions 6.3, 6.4, 6.5, 18.2 versions prior to patch 83, and 19.1 versions prior to patch 71 contain a serv (CVSS 9.1, Dell Data Protection Advisor)
- [CVE-2019-18581](https://cve.now/CVE-2019-18581.md): Dell EMC Data Protection Advisor versions 6.3, 6.4, 6.5, 18.2 versions prior to patch 83, and 19.1 versions prior to patch 71 contain a serv (CVSS 9.1, Dell Data Protection Advisor)
- [CVE-2019-20512](https://cve.now/CVE-2019-20512.md): Open edX Ironwood.1 allows support/certificates?course\_id= reflected XSS. (no CVSS)
- [CVE-2019-20511](https://cve.now/CVE-2019-20511.md): ERPNext 11.1.47 allows blog?blog\_category= Frame Injection. (CVSS 4.7)
- [CVE-2019-12921](https://cve.now/CVE-2019-12921.md): In GraphicsMagick before 1.3.32, the text filename component allows remote attackers to read arbitrary files via a crafted image because of (no CVSS)
- [CVE-2019-12769](https://cve.now/CVE-2019-12769.md): SolarWinds Serv-U Managed File Transfer (MFT) Web client before 15.1.6 Hotfix 2 is vulnerable to Cross-Site Request Forgery in the file uplo (no CVSS)
- [CVE-2019-12370](https://cve.now/CVE-2019-12370.md): The Spark application through 2.0.2 for Android allows XSS via an event attribute and arbitrary file loading via a src attribute, if the app (no CVSS)
- [CVE-2019-12369](https://cve.now/CVE-2019-12369.md): The TypeApp application through 1.9.5.35 for Android allows XSS via an event attribute and arbitrary file loading via a src attribute, if th (no CVSS)
- [CVE-2019-12368](https://cve.now/CVE-2019-12368.md): The Edison Mail application through 1.7.1 for Android allows XSS via an event attribute and arbitrary file loading via a src attribute, if t (no CVSS)
- [CVE-2019-12367](https://cve.now/CVE-2019-12367.md): The BlueMail application through 1.9.5.36 for Android allows XSS via an event attribute and arbitrary file loading via a src attribute, if t (no CVSS)
- [CVE-2019-20529](https://cve.now/CVE-2019-20529.md): In core/doctype/prepared\_report/prepared\_report.py in Frappe 11 and 12, data files generated with Prepared Report were being stored as publi (no CVSS)
- [CVE-2019-12366](https://cve.now/CVE-2019-12366.md): The Nine application through 4.5.3a for Android allows XSS via an event attribute and arbitrary file loading via a src attribute, if the app (no CVSS)
- [CVE-2019-12365](https://cve.now/CVE-2019-12365.md): The Newton application through 10.0.23 for Android allows XSS via an event attribute and arbitrary file loading via a src attribute, if the (no CVSS)
- [CVE-2019-12131](https://cve.now/CVE-2019-12131.md): An issue was detected in ONAP APPC through Dublin and SDC through Dublin. (no CVSS)
- [CVE-2019-12132](https://cve.now/CVE-2019-12132.md): An issue was discovered in ONAP SDNC before Dublin. (no CVSS)
- [CVE-2019-12124](https://cve.now/CVE-2019-12124.md): An issue was discovered in ONAP APPC before Dublin. (no CVSS)
- [CVE-2019-12123](https://cve.now/CVE-2019-12123.md): An issue was discovered in ONAP SDNC before Dublin. (no CVSS)
- [CVE-2019-12122](https://cve.now/CVE-2019-12122.md): An issue was discovered in ONAP Portal through Dublin. (no CVSS)
- [CVE-2019-12121](https://cve.now/CVE-2019-12121.md): An issue was detected in ONAP Portal through Dublin. (no CVSS)
- [CVE-2019-12120](https://cve.now/CVE-2019-12120.md): An issue was discovered in ONAP VNFSDK through Dublin. (no CVSS)
- [CVE-2019-12119](https://cve.now/CVE-2019-12119.md): An issue was discovered in ONAP SDC through Dublin. (no CVSS)
- [CVE-2019-12118](https://cve.now/CVE-2019-12118.md): An issue was discovered in ONAP SDC through Dublin. (no CVSS)
- [CVE-2019-12117](https://cve.now/CVE-2019-12117.md): An issue was discovered in ONAP SDC through Dublin. (no CVSS)
- [CVE-2019-12116](https://cve.now/CVE-2019-12116.md): An issue was discovered in ONAP SDC through Dublin. (no CVSS)
- [CVE-2019-12115](https://cve.now/CVE-2019-12115.md): An issue was discovered in ONAP SDC through Dublin. (no CVSS)
- [CVE-2019-12114](https://cve.now/CVE-2019-12114.md): An issue was discovered in ONAP HOLMES before Dublin. (no CVSS)
- [CVE-2019-12113](https://cve.now/CVE-2019-12113.md): An issue was discovered in ONAP SDNC before Dublin. (no CVSS)
- [CVE-2019-12112](https://cve.now/CVE-2019-12112.md): An issue was discovered in ONAP SDNC before Dublin. (no CVSS)
- [CVE-2019-19355](https://cve.now/CVE-2019-19355.md): An insecure modification vulnerability in the /etc/passwd file was found in the openshift/ocp-release-operator-sdk. (CVSS 7.0, Red Hat openshift)
- [CVE-2019-19351](https://cve.now/CVE-2019-19351.md): An insecure modification vulnerability in the /etc/passwd file was found in the container openshift/jenkins. (CVSS 7.0, Red Hat openshift)
- [CVE-2019-19335](https://cve.now/CVE-2019-19335.md): During installation of an OpenShift 4 cluster, the \`openshift-install\` command line tool creates an \`auth\` directory, with \`kubeconfig\` and (CVSS 4.4, Red Hat openshift/installer)
- [CVE-2019-14871](https://cve.now/CVE-2019-14871.md): The REENT\_CHECK macro (see newlib/libc/include/sys/reent.h) as used by REENT\_CHECK\_TM, REENT\_CHECK\_MISC, REENT\_CHECK\_MP and other newlib mac (CVSS 6.5, Red Hat newlib)
- [CVE-2019-10682](https://cve.now/CVE-2019-10682.md): django-nopassword before 5.0.0 stores cleartext secrets in the database. (no CVSS, django-nopassword)
- [CVE-2019-11689](https://cve.now/CVE-2019-11689.md): An issue was discovered in ASUSTOR exFAT Driver through 1.0.0.r20. (no CVSS)
- [CVE-2019-11688](https://cve.now/CVE-2019-11688.md): An issue was discovered in ASUSTOR exFAT Driver through 1.0.0.r20. (no CVSS)
- [CVE-2019-10178](https://cve.now/CVE-2019-10178.md): It was found that the Token Processing Service (TPS) did not properly sanitize the Token IDs from the "Activity" page, enabling a Stored Cro (CVSS 4.6, The pki-core Project pki-core)
- [CVE-2019-10146](https://cve.now/CVE-2019-10146.md): A Reflected Cross Site Scripting flaw was found in all pki-core 10.x.x versions module from the pki-core server due to the CA Agent Service (CVSS 4.7, Red Hat pki-core)
- [CVE-2020-9326](https://cve.now/CVE-2020-9326.md): BeyondTrust Privilege Management for Windows and Mac (aka PMWM; formerly Avecto Defendpoint) 5.1 through 5.5 before 5.5 SR1 mishandles comma (no CVSS)
- [CVE-2020-4199](https://cve.now/CVE-2020-4199.md): IBM Tivoli Netcool/OMNIbus 8.1.0 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthor (CVSS 4.3, IBM Tivoli Netcool/OMNIbus)
- [CVE-2020-9325](https://cve.now/CVE-2020-9325.md): Aquaforest TIFF Server 4.0 allows Unauthenticated Arbitrary File Download. (no CVSS)
- [CVE-2020-9324](https://cve.now/CVE-2020-9324.md): Aquaforest TIFF Server 4.0 allows Unauthenticated SMB Hash Capture via UNC. (no CVSS)
- [CVE-2020-9323](https://cve.now/CVE-2020-9323.md): Aquaforest TIFF Server 4.0 allows Unauthenticated File and Directory Enumeration via tiffserver/tssp.aspx. (no CVSS)
- [CVE-2020-6976](https://cve.now/CVE-2020-6976.md): Delta Industrial Automation CNCSoft ScreenEditor, v1.00.96 and prior. (no CVSS, Delta Industrial Automation CNCSoft ScreenEditor)
- [CVE-2020-7002](https://cve.now/CVE-2020-7002.md): Delta Industrial Automation CNCSoft ScreenEditor, v1.00.96 and prior. (no CVSS, Delta Industrial Automation CNCSoft ScreenEditor)
- [CVE-2020-9443](https://cve.now/CVE-2020-9443.md): Zulip Desktop before 4.0.3 loaded untrusted content in an Electron webview with web security disabled, which can be exploited for XSS in a n (no CVSS)
- [CVE-2019-14881](https://cve.now/CVE-2019-14881.md): A vulnerability was found in moodle 3.7 before 3.7.3, where there is blind XSS reflected in some locations where user email is displayed. (CVSS 6.1, \[UNKNOWN\] moodle · moodle/moodle)
- [CVE-2019-14884](https://cve.now/CVE-2019-14884.md): A vulnerability was found in Moodle 3.7 before 3.73, 3.6 before 3.6.7 and 3.5 before 3.5.9, where a reflected XSS possible from some fatal e (CVSS 6.1, \[UNKNOWN\] moodle · moodle/moodle)
- [CVE-2019-14883](https://cve.now/CVE-2019-14883.md): A vulnerability was found in Moodle 3.6 before 3.6.7 and 3.7 before 3.7.3, where tokens used to fetch inline atachments in email notificatio (CVSS 3.7, \[UNKNOWN\] moodle · moodle/moodle)
- [CVE-2019-14882](https://cve.now/CVE-2019-14882.md): A vulnerability was found in Moodle 3.7 to 3.7.3, 3.6 to 3.6.7, 3.5 to 3.5.9 and earlier where an open redirect existed in the Lesson edit p (CVSS 3.1, \[UNKNOWN\] moodle · moodle/moodle)
- [CVE-2020-3922](https://cve.now/CVE-2020-3922.md): ArmorX LisoMail - SQL Injection (CVSS 9.8, ArmorX LisoMail)
- [CVE-2020-10659](https://cve.now/CVE-2020-10659.md): Entrust Entelligence Security Provider (ESP) before 10.0.60 on Windows mishandles errors during SSL Certificate Validation, leading to situa (no CVSS)
- [CVE-2019-11939](https://cve.now/CVE-2019-11939.md): Golang Facebook Thrift servers would not error upon receiving messages declaring containers of sizes larger than the payload. (no CVSS, Facebook Thrift · github.com/facebook/fbthrift)
- [CVE-2020-8600](https://cve.now/CVE-2020-8600.md): Trend Micro Worry-Free Business Security (9.0, 9.5, 10.0) is affected by a directory traversal vulnerability that could allow an attacker to (no CVSS, Trend Micro Worry-Free Business Security)
- [CVE-2020-8470](https://cve.now/CVE-2020-8470.md): Trend Micro Apex One (2019), OfficeScan XG and Worry-Free Business Security (9.0, 9.5, 10.0) server contains a vulnerable service DLL file t (no CVSS, Trend Micro OfficeScan, Trend Micro Apex One, Trend Micro W…)
- [CVE-2020-8598](https://cve.now/CVE-2020-8598.md): Trend Micro Apex One (2019), OfficeScan XG and Worry-Free Business Security (9.0, 9.5, 10.0) server contains a vulnerable service DLL file t (no CVSS, Trend Micro OfficeScan, Trend Micro Apex One, Trend Micro W…)
- [CVE-2020-8599](https://cve.now/CVE-2020-8599.md): Trend Micro Apex One (2019) and OfficeScan XG server contain a vulnerable EXE file that could allow a remote attacker to write arbitrary dat (CVSS 9.8, KEV, Trend Micro OfficeScan, Trend Micro Apex One)
- [CVE-2020-8467](https://cve.now/CVE-2020-8467.md): A migration tool component of Trend Micro Apex One (2019) and OfficeScan XG contains a vulnerability which could allow remote attackers to e (CVSS 8.8, KEV, Trend Micro OfficeScan, Trend Micro Apex One)
- [CVE-2020-8468](https://cve.now/CVE-2020-8468.md): Trend Micro Apex One (2019), OfficeScan XG and Worry-Free Business Security (9.0, 9.5, 10.0) agents are affected by a content validation esc (CVSS 8.8, KEV, Trend Micro OfficeScan, Trend Micro Apex One, Trend Micro W…)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2020-03-18
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.