# CVEs published 2020-03-19

78 CVEs were published on March 19, 2020: 0 critical, 13 high. Days are UTC.

- [CVE-2019-16071](https://cve.now/CVE-2019-16071.md): Enigma NMS 65.0.0 and prior allows administrative users to create low-privileged accounts that do not have the ability to modify any setting (no CVSS)
- [CVE-2019-16072](https://cve.now/CVE-2019-16072.md): An OS command injection vulnerability in the discover\_and\_manage CGI script in NETSAS Enigma NMS 65.0.0 and prior allows an attacker to exec (no CVSS)
- [CVE-2019-16108](https://cve.now/CVE-2019-16108.md): phpBB 3.2.7 allows adding an arbitrary Cascading Style Sheets (CSS) token sequence to a page through BBCode. (no CVSS, phpbb/phpbb)
- [CVE-2019-16069](https://cve.now/CVE-2019-16069.md): A number of stored Cross-site Scripting (XSS) vulnerabilities were identified in NETSAS Enigma NMS 65.0.0 and prior that could allow a threa (no CVSS)
- [CVE-2019-16068](https://cve.now/CVE-2019-16068.md): A CSRF vulnerability exists in NETSAS ENIGMA NMS version 65.0.0 and prior that could allow an attacker to be able to trick a victim into sub (no CVSS)
- [CVE-2019-16529](https://cve.now/CVE-2019-16529.md): An issue was discovered in the CheckUser extension through 1.35.0 for MediaWiki. (no CVSS)
- [CVE-2020-10669](https://cve.now/CVE-2020-10669.md): The web application exposed by the Canon Oce Colorwave 500 4.0.0.0 printer is vulnerable to authentication bypass on the page /home.jsp. (no CVSS)
- [CVE-2019-16063](https://cve.now/CVE-2019-16063.md): NETSAS Enigma NMS 65.0.0 and prior does not encrypt sensitive data rendered within web pages. (no CVSS)
- [CVE-2020-7006](https://cve.now/CVE-2020-7006.md): Systech Corporation NDS-5000 Terminal Server, NDS/5008 (8 Port, RJ45), firmware Version 02D.30. (no CVSS, Systech Corporation NDS-5000 Terminal Server)
- [CVE-2019-15539](https://cve.now/CVE-2019-15539.md): The proj\_doc\_edit\_page.php Project Documentation feature in MantisBT before 2.21.3 has a stored cross-site scripting (XSS) vulnerability, al (no CVSS, mantisbt/mantisbt)
- [CVE-2020-10671](https://cve.now/CVE-2020-10671.md): The Canon Oce Colorwave 500 4.0.0.0 printer's web application is missing any form of CSRF protections. (no CVSS)
- [CVE-2020-10670](https://cve.now/CVE-2020-10670.md): The web application exposed by the Canon Oce Colorwave 500 4.0.0.0 printer is vulnerable to Reflected XSS in the parameter settingId of the (no CVSS)
- [CVE-2020-10668](https://cve.now/CVE-2020-10668.md): The web application exposed by the Canon Oce Colorwave 500 4.0.0.0 printer is vulnerable to Reflected XSS in /home.jsp. (no CVSS)
- [CVE-2019-15124](https://cve.now/CVE-2019-15124.md): In the MobileFrontend extension for MediaWiki, XSS exists within the edit summary field of the watchlist feed. (no CVSS)
- [CVE-2020-10667](https://cve.now/CVE-2020-10667.md): The web application exposed by the Canon Oce Colorwave 500 4.0.0.0 printer is vulnerable to Stored XSS in /TemplateManager/indexExternalLoca (no CVSS)
- [CVE-2019-16070](https://cve.now/CVE-2019-16070.md): A number of stored Cross-site Scripting (XSS) vulnerabilities were identified in NETSAS Enigma NMS 65.0.0 and prior that could allow a threa (no CVSS)
- [CVE-2019-20526](https://cve.now/CVE-2019-20526.md): Ignite Realtime Openfire 4.4.1 allows XSS via the setup/setup-datasource-standard.jsp password parameter. (no CVSS, org.igniterealtime.openfire:parent)
- [CVE-2019-16067](https://cve.now/CVE-2019-16067.md): NETSAS Enigma NMS 65.0.0 and prior utilises basic authentication over HTTP for enforcing access control to the web application. (no CVSS)
- [CVE-2019-20525](https://cve.now/CVE-2019-20525.md): Ignite Realtime Openfire 4.4.1 allows XSS via the setup/setup-datasource-standard.jsp driver parameter. (no CVSS, org.igniterealtime.openfire:parent)
- [CVE-2019-16066](https://cve.now/CVE-2019-16066.md): An unrestricted file upload vulnerability exists in user and system file upload functions in NETSAS Enigma NMS 65.0.0 and prior. (no CVSS)
- [CVE-2019-16065](https://cve.now/CVE-2019-16065.md): A remote SQL injection web vulnerability was discovered in the Enigma NMS 65.0.0 and prior web application that allows an attacker to execut (no CVSS)
- [CVE-2019-16064](https://cve.now/CVE-2019-16064.md): NETSAS Enigma NMS 65.0.0 and prior suffers from a directory traversal vulnerability that can allow an authenticated user to access files and (no CVSS)
- [CVE-2019-16062](https://cve.now/CVE-2019-16062.md): NETSAS Enigma NMS 65.0.0 and prior does not encrypt sensitive data stored within the SQL database. (no CVSS)
- [CVE-2019-20521](https://cve.now/CVE-2019-20521.md): ERPNext 11.1.47 allows reflected XSS via the PATH\_INFO to the api/ URI. (CVSS 7.4)
- [CVE-2019-20520](https://cve.now/CVE-2019-20520.md): ERPNext 11.1.47 allows reflected XSS via the PATH\_INFO to the api/method/ URI. (CVSS 7.4)
- [CVE-2019-20519](https://cve.now/CVE-2019-20519.md): ERPNext 11.1.47 allows reflected XSS via the PATH\_INFO to the user/ URI, as demonstrated by a crafted e-mail address. (CVSS 7.4)
- [CVE-2019-20518](https://cve.now/CVE-2019-20518.md): ERPNext 11.1.47 allows reflected XSS via the PATH\_INFO to the project/ URI. (CVSS 7.4)
- [CVE-2019-16061](https://cve.now/CVE-2019-16061.md): A number of files on the NETSAS Enigma NMS server 65.0.0 and prior are granted weak world-readable and world-writable permissions, allowing (no CVSS)
- [CVE-2019-20517](https://cve.now/CVE-2019-20517.md): ERPNext 11.1.47 allows reflected XSS via the PATH\_INFO to the contact/ URI. (CVSS 7.4)
- [CVE-2019-20516](https://cve.now/CVE-2019-20516.md): ERPNext 11.1.47 allows reflected XSS via the PATH\_INFO to the blog/ URI. (CVSS 7.4)
- [CVE-2019-20515](https://cve.now/CVE-2019-20515.md): ERPNext 11.1.47 allows reflected XSS via the PATH\_INFO to the addresses/ URI. (CVSS 7.4)
- [CVE-2019-20514](https://cve.now/CVE-2019-20514.md): ERPNext 11.1.47 allows reflected XSS via the PATH\_INFO to the address/ URI. (CVSS 7.4)
- [CVE-2019-20513](https://cve.now/CVE-2019-20513.md): Open edX Ironwood.1 allows support/certificates?user= reflected XSS. (no CVSS)
- [CVE-2019-12127](https://cve.now/CVE-2019-12127.md): In ONAP OOM through Dublin, by accessing an applicable port (30234, 30290, 32010, 30270, 30224, 30281, 30254, 30285, and/or 30271), an attac (no CVSS)
- [CVE-2019-12126](https://cve.now/CVE-2019-12126.md): In ONAP DCAE through Dublin, by accessing an applicable port (30234, 30290, 32010, 30270, 30224, 30281, 30254, 30285, and/or 30271), an atta (no CVSS)
- [CVE-2019-12125](https://cve.now/CVE-2019-12125.md): In ONAP Logging through Dublin, by accessing an applicable port (30234, 30290, 32010, 30270, 30224, 30281, 30254, 30285, and/or 30271), an a (no CVSS)
- [CVE-2020-5267](https://cve.now/CVE-2020-5267.md): Possible XSS vulnerability in ActionView (CVSS 4.0, rails actionview · actionview)
- [CVE-2019-15656](https://cve.now/CVE-2019-15656.md): D-Link DSL-2875AL and DSL-2877AL devices through 1.00.05 are prone to information disclosure via a simple crafted request to index.asp on th (no CVSS)
- [CVE-2019-15655](https://cve.now/CVE-2019-15655.md): D-Link DSL-2875AL devices through 1.00.05 are prone to password disclosure via a simple crafted /romfile.cfg request to the web management s (no CVSS)
- [CVE-2019-15654](https://cve.now/CVE-2019-15654.md): Comba AC2400 devices are prone to password disclosure via a simple crafted /09/business/upgrade/upcfgAction.php?download=true request to the (no CVSS)
- [CVE-2019-15653](https://cve.now/CVE-2019-15653.md): Comba AP2600-I devices through A02,0202N00PD2 are prone to password disclosure via an insecure authentication mechanism. (no CVSS)
- [CVE-2019-16338](https://cve.now/CVE-2019-16338.md): The tfo\_common component in HwordApp.dll in Hancom Office 9.6.1.7634 allows a use-after-free via a crafted .docx file. (no CVSS)
- [CVE-2019-16337](https://cve.now/CVE-2019-16337.md): The hncbd90 component in Hancom Office 9.6.1.9403 allows a use-after-free via an unknown object in a crafted .docx file. (no CVSS)
- [CVE-2020-5262](https://cve.now/CVE-2020-5262.md): GitHub personal access token leaking into temporary EasyBuild (debug) logs (CVSS 7.7, easybuilders easybuild-framework · easybuild-framework +1)
- [CVE-2019-16382](https://cve.now/CVE-2019-16382.md): An issue was discovered in Ivanti Workspace Control 10.3.110.0. (no CVSS)
- [CVE-2019-11361](https://cve.now/CVE-2019-11361.md): Zoho ManageEngine Remote Access Plus 10.0.258 does not validate user permissions properly, allowing for privilege escalation and eventually (no CVSS)
- [CVE-2014-2723](https://cve.now/CVE-2014-2723.md): In FortiBalancer 400, 1000, 2000 and 3000, a platform-specific remote access vulnerability has been discovered that may allow a remote user (no CVSS)
- [CVE-2014-2721](https://cve.now/CVE-2014-2721.md): In FortiBalancer 400, 1000, 2000 and 3000, a platform-specific remote access vulnerability has been discovered that may allow a remote user (no CVSS)
- [CVE-2019-16010](https://cve.now/CVE-2019-16010.md): Cisco SD-WAN Solution vManage Stored Cross-Site Scripting Vulnerability (CVSS 5.5, Cisco vManage Software)
- [CVE-2019-16012](https://cve.now/CVE-2019-16012.md): Cisco SD-WAN Solution vManage SQL Injection Vulnerability (CVSS 5.4, Cisco vManage Software)
- [CVE-2020-3264](https://cve.now/CVE-2020-3264.md): Cisco SD-WAN Solution Buffer Overflow Vulnerability (CVSS 7.1, Cisco SD-WAN Solution)
- [CVE-2020-3265](https://cve.now/CVE-2020-3265.md): Cisco SD-WAN Solution Privilege Escalation Vulnerability (CVSS 7.0, Cisco SD-WAN Solution)
- [CVE-2020-3266](https://cve.now/CVE-2020-3266.md): Cisco SD-WAN Solution Command Injection Vulnerability (CVSS 7.8, Cisco SD-WAN Solution)
- [CVE-2014-2722](https://cve.now/CVE-2014-2722.md): In FortiBalancer 400, 1000, 2000 and 3000, a platform-specific remote access vulnerability has been discovered that may allow a remote user (no CVSS)
- [CVE-2020-1705](https://cve.now/CVE-2020-1705.md): A vulnerability was found in openshift/template-service-broker-operator in all 4.x.x versions prior to 4.3.0, where an insecure modification (CVSS 7.0, Red Hat openshift/template-service-broker-operator)
- [CVE-2019-14876](https://cve.now/CVE-2019-14876.md): In the \_\_lshift function of the newlib libc library, all versions prior to 3.3.0 (see newlib/libc/stdlib/mprec.c), Balloc is used to allocat (CVSS 6.5, Red Hat newlib)
- [CVE-2019-14875](https://cve.now/CVE-2019-14875.md): In the \_\_multiply function of the newlib libc library, all versions prior to 3.3.0 (see newlib/libc/stdlib/mprec.c), Balloc is used to alloc (CVSS 6.5, Red Hat newlib)
- [CVE-2019-14874](https://cve.now/CVE-2019-14874.md): In the \_\_i2b function of the newlib libc library, all versions prior to 3.3.0 (see newlib/libc/stdlib/mprec.c), Balloc is used to allocate a (CVSS 6.5, Red Hat newlib)
- [CVE-2019-14878](https://cve.now/CVE-2019-14878.md): In the \_\_d2b function of the newlib libc library, all versions prior to 3.3.0 (see newlib/libc/stdlib/mprec.c), Balloc is used to allocate a (CVSS 6.5, Red Hat newlib)
- [CVE-2019-14877](https://cve.now/CVE-2019-14877.md): In the \_\_mdiff function of the newlib libc library, all versions prior to 3.3.0 (see newlib/libc/stdlib/mprec.c), Balloc is used to allocate (CVSS 6.5, Red Hat newlib)
- [CVE-2019-14873](https://cve.now/CVE-2019-14873.md): In the \_\_multadd function of the newlib libc library, prior to versions 3.3.0 (see newlib/libc/stdlib/mprec.c), Balloc is used to allocate a (CVSS 6.5, Red Hat newlib)
- [CVE-2019-12416](https://cve.now/CVE-2019-12416.md): we got reports for 2 injection attacks against the DeltaSpike windowhandler.js. (no CVSS, Apache DeltaSpike · org.apache.deltaspike:deltaspike)
- [CVE-2020-10678](https://cve.now/CVE-2020-10678.md): In Octopus Deploy before 2020.1.5, for customers running on-premises Active Directory linked to their Octopus server, an authenticated user (no CVSS)
- [CVE-2019-20522](https://cve.now/CVE-2019-20522.md): ilchCMS 2.1.23 allows XSS via the index.php/partner/index Link parameter. (no CVSS)
- [CVE-2019-20523](https://cve.now/CVE-2019-20523.md): ilchCMS 2.1.23 allows XSS via the index.php/partner/index Name parameter. (no CVSS)
- [CVE-2019-20527](https://cve.now/CVE-2019-20527.md): Ignite Realtime Openfire 4.4.1 allows XSS via the setup/setup-datasource-standard.jsp serverURL parameter. (no CVSS, org.igniterealtime.openfire:parent)
- [CVE-2019-20524](https://cve.now/CVE-2019-20524.md): ilchCMS 2.1.23 allows XSS via the index.php/partner/index Banner parameter. (no CVSS)
- [CVE-2019-12130](https://cve.now/CVE-2019-12130.md): In ONAP CLI through Dublin, by accessing an applicable port (30234, 30290, 32010, 30270, 30224, 30281, 30254, 30285, and/or 30271), an attac (no CVSS)
- [CVE-2019-12129](https://cve.now/CVE-2019-12129.md): In ONAP MSB through Dublin, by accessing an applicable port (30234, 30290, 32010, 30270, 30224, 30281, 30254, 30285, and/or 30271), an attac (no CVSS)
- [CVE-2019-12128](https://cve.now/CVE-2019-12128.md): In ONAP SO through Dublin, by accessing an applicable port (30234, 30290, 32010, 30270, 30224, 30281, 30254, 30285, and/or 30271), an attack (no CVSS)
- [CVE-2020-4205](https://cve.now/CVE-2020-4205.md): IBM DataPower Gateway 2018.4.1.0 through 2018.4.1.8 could allow an authenticated user to bypass security restrictions, and continue to acces (CVSS 5.0, IBM DataPower Gateway)
- [CVE-2020-4203](https://cve.now/CVE-2020-4203.md): IBM DataPower Gateway 2018.4.1.0 through 2018.4.1.8 could potentially disclose highly sensitive information to a privileged user due to impr (CVSS 4.9, IBM DataPower Gateway)
- [CVE-2020-10648](https://cve.now/CVE-2020-10648.md): Das U-Boot through 2020.01 allows attackers to bypass verified boot restrictions and subsequently boot arbitrary images by providing a craft (no CVSS)
- [CVE-2020-10675](https://cve.now/CVE-2020-10675.md): The Library API in buger jsonparser through 2019-12-04 allows attackers to cause a denial of service (infinite loop) via a Delete call. (no CVSS, github.com/buger/jsonparser)
- [CVE-2019-19336](https://cve.now/CVE-2019-19336.md): A cross-site scripting vulnerability was reported in the oVirt-engine's OAuth authorization endpoint before version 4.3.8. (CVSS 5.4, Red Hat ovirt-engine)
- [CVE-2019-14872](https://cve.now/CVE-2019-14872.md): The \_dtoa\_r function of the newlib libc library, prior to version 3.3.0, performs multiple memory allocations without checking their return (CVSS 6.5, Red Hat newlib)
- [CVE-2019-20485](https://cve.now/CVE-2019-20485.md): qemu/qemu\_driver.c in libvirt before 6.0.0 mishandles the holding of a monitor job during a query to a guest agent, which allows attackers t (no CVSS)
- [CVE-2019-16375](https://cve.now/CVE-2019-16375.md): An issue was discovered in Open Ticket Request System (OTRS) 7.0.x through 7.0.11, and Community Edition 5.0.x through 5.0.37 and 6.0.x thro (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2020-03-19
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.