CVEs published March 19, 2020
78 CVEs were published on March 19, 2020: 0 critical, 13 high.
- Published
- 78
- Critical
- 0
- High
- 13
- Medium
- 13
- Low
- 0
- Unrated
- 52
- Now in CISA KEV
- 0
- Fix available
- 9
Most affected products
- Red Hat newlib
- 7
- Cisco SD-WAN Solution
- 3
- org.igniterealtime.openfire:parent
- 3
- Cisco vManage Software
- 2
- IBM DataPower Gateway
- 2
- Apache DeltaSpike · org.apache.deltaspike:deltaspike
- 1
- easybuilders easybuild-framework · easybuild-framework +1
- 1
- github.com/buger/jsonparser
- 1
- mantisbt/mantisbt
- 1
- phpbb/phpbb
- 1
High 13
- CVE-2019-20521ERPNext 11.1.47 allows reflected XSS via the PATH_INFO to the api/ URI.
- CVE-2019-20520ERPNext 11.1.47 allows reflected XSS via the PATH_INFO to the api/method/ URI.
- CVE-2019-20519ERPNext 11.1.47 allows reflected XSS via the PATH_INFO to the user/ URI, as demonstrated by a crafted e-mail address.
- CVE-2019-20518ERPNext 11.1.47 allows reflected XSS via the PATH_INFO to the project/ URI.
- CVE-2019-20517ERPNext 11.1.47 allows reflected XSS via the PATH_INFO to the contact/ URI.
- CVE-2019-20516ERPNext 11.1.47 allows reflected XSS via the PATH_INFO to the blog/ URI.
- CVE-2019-20515ERPNext 11.1.47 allows reflected XSS via the PATH_INFO to the addresses/ URI.
- CVE-2019-20514ERPNext 11.1.47 allows reflected XSS via the PATH_INFO to the address/ URI.
- CVE-2020-5262GitHub personal access token leaking into temporary EasyBuild (debug) logseasybuilders easybuild-framework · easybuild-framework +1
- CVE-2020-3264Cisco SD-WAN Solution Buffer Overflow VulnerabilityCisco SD-WAN Solution
- CVE-2020-3265Cisco SD-WAN Solution Privilege Escalation VulnerabilityCisco SD-WAN Solution
- CVE-2020-3266Cisco SD-WAN Solution Command Injection VulnerabilityCisco SD-WAN Solution
- CVE-2020-1705A vulnerability was found in openshift/template-service-broker-operator in all 4.x.x versions prior to 4.3.0, where an insecure modificationRed Hat openshift/template-service-broker-operator
Medium, low and unrated 65
- CVE-2019-16071Enigma NMS 65.0.0 and prior allows administrative users to create low-privileged accounts that do not have the ability to modify any setting
- CVE-2019-16072An OS command injection vulnerability in the discover_and_manage CGI script in NETSAS Enigma NMS 65.0.0 and prior allows an attacker to exec
- CVE-2019-16108phpBB 3.2.7 allows adding an arbitrary Cascading Style Sheets (CSS) token sequence to a page through BBCode.phpbb/phpbb
- CVE-2019-16069A number of stored Cross-site Scripting (XSS) vulnerabilities were identified in NETSAS Enigma NMS 65.0.0 and prior that could allow a threa
- CVE-2019-16068A CSRF vulnerability exists in NETSAS ENIGMA NMS version 65.0.0 and prior that could allow an attacker to be able to trick a victim into sub
- CVE-2019-16529An issue was discovered in the CheckUser extension through 1.35.0 for MediaWiki.
- CVE-2020-10669The web application exposed by the Canon Oce Colorwave 500 4.0.0.0 printer is vulnerable to authentication bypass on the page /home.jsp.
- CVE-2019-16063NETSAS Enigma NMS 65.0.0 and prior does not encrypt sensitive data rendered within web pages.
- CVE-2020-7006Systech Corporation NDS-5000 Terminal Server, NDS/5008 (8 Port, RJ45), firmware Version 02D.30.Systech Corporation NDS-5000 Terminal Server
- CVE-2019-15539The proj_doc_edit_page.php Project Documentation feature in MantisBT before 2.21.3 has a stored cross-site scripting (XSS) vulnerability, almantisbt/mantisbt
- CVE-2020-10671The Canon Oce Colorwave 500 4.0.0.0 printer's web application is missing any form of CSRF protections.
- CVE-2020-10670The web application exposed by the Canon Oce Colorwave 500 4.0.0.0 printer is vulnerable to Reflected XSS in the parameter settingId of the
- CVE-2020-10668The web application exposed by the Canon Oce Colorwave 500 4.0.0.0 printer is vulnerable to Reflected XSS in /home.jsp.
- CVE-2019-15124In the MobileFrontend extension for MediaWiki, XSS exists within the edit summary field of the watchlist feed.
- CVE-2020-10667The web application exposed by the Canon Oce Colorwave 500 4.0.0.0 printer is vulnerable to Stored XSS in /TemplateManager/indexExternalLoca
- CVE-2019-16070A number of stored Cross-site Scripting (XSS) vulnerabilities were identified in NETSAS Enigma NMS 65.0.0 and prior that could allow a threa
- CVE-2019-20526Ignite Realtime Openfire 4.4.1 allows XSS via the setup/setup-datasource-standard.jsp password parameter.org.igniterealtime.openfire:parent
- CVE-2019-16067NETSAS Enigma NMS 65.0.0 and prior utilises basic authentication over HTTP for enforcing access control to the web application.
- CVE-2019-20525Ignite Realtime Openfire 4.4.1 allows XSS via the setup/setup-datasource-standard.jsp driver parameter.org.igniterealtime.openfire:parent
- CVE-2019-16066An unrestricted file upload vulnerability exists in user and system file upload functions in NETSAS Enigma NMS 65.0.0 and prior.
- CVE-2019-16065A remote SQL injection web vulnerability was discovered in the Enigma NMS 65.0.0 and prior web application that allows an attacker to execut
- CVE-2019-16064NETSAS Enigma NMS 65.0.0 and prior suffers from a directory traversal vulnerability that can allow an authenticated user to access files and
- CVE-2019-16062NETSAS Enigma NMS 65.0.0 and prior does not encrypt sensitive data stored within the SQL database.
- CVE-2019-16061A number of files on the NETSAS Enigma NMS server 65.0.0 and prior are granted weak world-readable and world-writable permissions, allowing
- CVE-2019-20513Open edX Ironwood.1 allows support/certificates?user= reflected XSS.
- CVE-2019-12127In ONAP OOM through Dublin, by accessing an applicable port (30234, 30290, 32010, 30270, 30224, 30281, 30254, 30285, and/or 30271), an attac
- CVE-2019-12126In ONAP DCAE through Dublin, by accessing an applicable port (30234, 30290, 32010, 30270, 30224, 30281, 30254, 30285, and/or 30271), an atta
- CVE-2019-12125In ONAP Logging through Dublin, by accessing an applicable port (30234, 30290, 32010, 30270, 30224, 30281, 30254, 30285, and/or 30271), an a
- CVE-2020-5267Possible XSS vulnerability in ActionViewrails actionview · actionview
- CVE-2019-15656D-Link DSL-2875AL and DSL-2877AL devices through 1.00.05 are prone to information disclosure via a simple crafted request to index.asp on th
- CVE-2019-15655D-Link DSL-2875AL devices through 1.00.05 are prone to password disclosure via a simple crafted /romfile.cfg request to the web management s
- CVE-2019-15654Comba AC2400 devices are prone to password disclosure via a simple crafted /09/business/upgrade/upcfgAction.php?download=true request to the
- CVE-2019-15653Comba AP2600-I devices through A02,0202N00PD2 are prone to password disclosure via an insecure authentication mechanism.
- CVE-2019-16338The tfo_common component in HwordApp.dll in Hancom Office 9.6.1.7634 allows a use-after-free via a crafted .docx file.
- CVE-2019-16337The hncbd90 component in Hancom Office 9.6.1.9403 allows a use-after-free via an unknown object in a crafted .docx file.
- CVE-2019-16382An issue was discovered in Ivanti Workspace Control 10.3.110.0.
- CVE-2019-11361Zoho ManageEngine Remote Access Plus 10.0.258 does not validate user permissions properly, allowing for privilege escalation and eventually
- CVE-2014-2723In FortiBalancer 400, 1000, 2000 and 3000, a platform-specific remote access vulnerability has been discovered that may allow a remote user
- CVE-2014-2721In FortiBalancer 400, 1000, 2000 and 3000, a platform-specific remote access vulnerability has been discovered that may allow a remote user
- CVE-2019-16010Cisco SD-WAN Solution vManage Stored Cross-Site Scripting VulnerabilityCisco vManage Software
- CVE-2019-16012Cisco SD-WAN Solution vManage SQL Injection VulnerabilityCisco vManage Software
- CVE-2014-2722In FortiBalancer 400, 1000, 2000 and 3000, a platform-specific remote access vulnerability has been discovered that may allow a remote user
- CVE-2019-14876In the __lshift function of the newlib libc library, all versions prior to 3.3.0 (see newlib/libc/stdlib/mprec.c), Balloc is used to allocatRed Hat newlib
- CVE-2019-14875In the __multiply function of the newlib libc library, all versions prior to 3.3.0 (see newlib/libc/stdlib/mprec.c), Balloc is used to allocRed Hat newlib
- CVE-2019-14874In the __i2b function of the newlib libc library, all versions prior to 3.3.0 (see newlib/libc/stdlib/mprec.c), Balloc is used to allocate aRed Hat newlib
- CVE-2019-14878In the __d2b function of the newlib libc library, all versions prior to 3.3.0 (see newlib/libc/stdlib/mprec.c), Balloc is used to allocate aRed Hat newlib
- CVE-2019-14877In the __mdiff function of the newlib libc library, all versions prior to 3.3.0 (see newlib/libc/stdlib/mprec.c), Balloc is used to allocateRed Hat newlib
- CVE-2019-14873In the __multadd function of the newlib libc library, prior to versions 3.3.0 (see newlib/libc/stdlib/mprec.c), Balloc is used to allocate aRed Hat newlib
- CVE-2019-12416we got reports for 2 injection attacks against the DeltaSpike windowhandler.js.Apache DeltaSpike · org.apache.deltaspike:deltaspike
- CVE-2020-10678In Octopus Deploy before 2020.1.5, for customers running on-premises Active Directory linked to their Octopus server, an authenticated user
- CVE-2019-20522ilchCMS 2.1.23 allows XSS via the index.php/partner/index Link parameter.
- CVE-2019-20523ilchCMS 2.1.23 allows XSS via the index.php/partner/index Name parameter.
- CVE-2019-20527Ignite Realtime Openfire 4.4.1 allows XSS via the setup/setup-datasource-standard.jsp serverURL parameter.org.igniterealtime.openfire:parent
- CVE-2019-20524ilchCMS 2.1.23 allows XSS via the index.php/partner/index Banner parameter.
- CVE-2019-12130In ONAP CLI through Dublin, by accessing an applicable port (30234, 30290, 32010, 30270, 30224, 30281, 30254, 30285, and/or 30271), an attac
- CVE-2019-12129In ONAP MSB through Dublin, by accessing an applicable port (30234, 30290, 32010, 30270, 30224, 30281, 30254, 30285, and/or 30271), an attac
- CVE-2019-12128In ONAP SO through Dublin, by accessing an applicable port (30234, 30290, 32010, 30270, 30224, 30281, 30254, 30285, and/or 30271), an attack
- CVE-2020-4205IBM DataPower Gateway 2018.4.1.0 through 2018.4.1.8 could allow an authenticated user to bypass security restrictions, and continue to accesIBM DataPower Gateway
- CVE-2020-4203IBM DataPower Gateway 2018.4.1.0 through 2018.4.1.8 could potentially disclose highly sensitive information to a privileged user due to imprIBM DataPower Gateway
- CVE-2020-10648Das U-Boot through 2020.01 allows attackers to bypass verified boot restrictions and subsequently boot arbitrary images by providing a craft
- CVE-2020-10675The Library API in buger jsonparser through 2019-12-04 allows attackers to cause a denial of service (infinite loop) via a Delete call.github.com/buger/jsonparser
- CVE-2019-19336A cross-site scripting vulnerability was reported in the oVirt-engine's OAuth authorization endpoint before version 4.3.8.Red Hat ovirt-engine
- CVE-2019-14872The _dtoa_r function of the newlib libc library, prior to version 3.3.0, performs multiple memory allocations without checking their return Red Hat newlib
- CVE-2019-20485qemu/qemu_driver.c in libvirt before 6.0.0 mishandles the holding of a monitor job during a query to a guest agent, which allows attackers t
- CVE-2019-16375An issue was discovered in Open Ticket Request System (OTRS) 7.0.x through 7.0.11, and Community Edition 5.0.x through 5.0.37 and 6.0.x thro