CVEs published March 20, 2020
78 CVEs were published on March 20, 2020: 1 critical, 7 high. 1 is now in CISA KEV.
- Published
- 78
- Critical
- 1
- High
- 7
- Medium
- 4
- Low
- 3
- Unrated
- 63
- Now in CISA KEV
- 1
- Fix available
- 18
Most affected products
- Google Chrome
- 8
- Foxit Studio Photo
- 7
- github.com/goharbor/harbor
- 4
- HUAWEI Mate 20;HUAWEI Mate 30 Pro
- 4
- [UNKNOWN] pki-core
- 2
- Nextcloud Server
- 2
- [UNKNOWN] openshift/mediawiki
- 1
- [UNKNOWN] openshift/mediawiki-apb
- 1
- [UNKNOWN] openshift/postgresql-apb
- 1
- [UNKNOWN] pki-core/pki-kra
- 1
Critical 1
High 7
- CVE-2020-8880This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Studio Photo 3.6.6.916.Foxit Studio Photo
- CVE-2020-8881This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Studio Photo 3.6.6.916.Foxit Studio Photo
- CVE-2020-8882This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Studio Photo 3.6.6.916.Foxit Studio Photo
- CVE-2020-8878This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Studio Photo 3.6.6.916.Foxit Studio Photo
- CVE-2019-19345A vulnerability was found in all openshift/mediawiki-apb 4.x.x versions prior to 4.3.0, where an insecure modification vulnerability in the [UNKNOWN] openshift/mediawiki-apb
- CVE-2020-1707A vulnerability was found in all openshift/postgresql-apb 4.x.x versions prior to 4.3.0, where an insecure modification vulnerability in the[UNKNOWN] openshift/postgresql-apb
- CVE-2020-1709A vulnerability was found in all openshift/mediawiki 4.x.x versions prior to 4.3.0, where an insecure modification vulnerability in the /etc[UNKNOWN] openshift/mediawiki
Medium, low and unrated 70
- CVE-2020-10799The svglib package through 0.9.3 for Python allows XXE attacks via an svg2rlg call.svglib
- CVE-2019-11574An issue was discovered in Simple Machines Forum (SMF) before release 2.0.17.
- CVE-2019-13463An XSS vulnerability in qcopd-shortcode-generator.php in the Simple Link Directory plugin before 7.3.5 for WordPress allows remote attackers
- CVE-2019-16528An issue was discovered in the AbuseFilter extension for MediaWiki.
- CVE-2019-18641Rock RMS before 1.8.6 mishandles vCard access control within the People/GetVCard/REST controller.
- CVE-2019-18860Squid before 4.9, when certain web browsers are used, mishandles HTML in the host (aka hostname) parameter to cachemgr.cgi.
- CVE-2020-10194cs/service/account/AutoCompleteGal.java in Zimbra zm-mailbox before 8.8.15.p8 allows authenticated users to request any GAL account.
- CVE-2019-15522An issue was discovered in LINBIT csync2 through 2.0.
- CVE-2020-8140A code injection in Nextcloud Desktop Client 2.6.2 for macOS allowed to load arbitrary code when starting the client with DYLD_INSERT_LIBRARDesktop Client
- CVE-2020-8139A missing access control check in Nextcloud Server < 18.0.1, < 17.0.4, and < 16.0.9 causes hide-download shares to be downloadable when appeNextcloud Server
- CVE-2020-8138A missing check for IPv4 nested inside IPv6 in Nextcloud server < 17.0.1, < 16.0.7, and < 15.0.14 allowed a Server-Side Request Forgery (SSRNextcloud Server
- CVE-2020-8883This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit Studio Photo 3.6.6.916.Foxit Studio Photo
- CVE-2020-8879This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit Studio Photo 3.6.6.916.Foxit Studio Photo
- CVE-2020-8877This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit Studio Photo 3.6.6.916.Foxit Studio Photo
- CVE-2019-12498The WP Live Chat Support plugin before 8.0.33 for WordPress accepts certain REST API calls without invoking the wplc_api_permission_check pr
- CVE-2020-8134Server-side request forgery (SSRF) vulnerability in Ghost CMS < 3.10.0 allows an attacker to scan local or external network or otherwise intGhost
- CVE-2020-8137Code injection vulnerability in blamer 1.0.0 and earlier may result in remote code execution when the input can be controlled by an attackerblamer
- CVE-2020-8135The uppy npm package < 1.9.3 is vulnerable to a Server-Side Request Forgery (SSRF) vulnerability, which allows an attacker to scan local or uppy · @uppy/companion
- CVE-2020-8136Prototype pollution vulnerability in fastify-multipart < 1.0.5 allows an attacker to crash fastify applications parsing multipart requests bfastify-multipart
- CVE-2020-10558The driving interface of Tesla Model 3 vehicles in any release before 2020.4.10 allows Denial of Service to occur due to improper process se
- CVE-2020-10792openITCOCKPIT through 3.7.2 allows remote attackers to configure the self::DEVELOPMENT or self::STAGING option by placing a hostname contain
- CVE-2020-9425An issue was discovered in includes/head.inc.php in rConfig before 3.9.4.
- CVE-2019-19324Xmidt cjwt through 1.0.1 before 2019-11-25 maps unsupported algorithms to alg=none, which sometimes leads to untrusted accidental JWT accept
- CVE-2019-15665An issue was discovered in Rivet Killer Control Center before 2.1.1352.
- CVE-2019-19148Tellabs Optical Line Terminal (OLT) 1150 devices allow Remote Command Execution via the -l option to TELNET or SSH.
- CVE-2019-15664An issue was discovered in Rivet Killer Control Center before 2.1.1352.
- CVE-2019-15663An issue was discovered in Rivet Killer Control Center before 2.1.1352.
- CVE-2019-16258The bootloader of the homee Brain Cube V2 through 2.23.0 allows attackers with physical access to gain root access by manipulating the U-Boo
- CVE-2019-15075An issue was discovered in iNextrix ASTPP before 4.0.1.
- CVE-2019-15662An issue was discovered in Rivet Killer Control Center before 2.1.1352.
- CVE-2019-15661An issue was discovered in Rivet Killer Control Center before 2.1.1352.
- CVE-2020-1879There is an improper integrity checking vulnerability on some huawei products.HEGE-560;HEGE-570;OSCA-550;OSCA-550A;OSCA-550AX;OSCA-550X
- CVE-2020-1794There is an improper authentication vulnerability in several smartphones.HUAWEI Mate 20;HUAWEI Mate 30 Pro
- CVE-2020-1864Some Huawei products have a security vulnerability due to improper authentication.Secospace AntiDDoS8000
- CVE-2020-1793There is an improper authentication vulnerability in several smartphones.HUAWEI Mate 20;HUAWEI Mate 30 Pro
- CVE-2020-1796There is an improper authorization vulnerability in several smartphones.HUAWEI Mate 20;HUAWEI Mate 30 Pro
- CVE-2020-1878Huawei smartphone OxfordS-AN00A with versions earlier than 10.0.1.152D(C735E152R3P3),versions earlier than 10.0.1.160(C00E160R4P1) have an iOxfordS-AN00A
- CVE-2020-1795There is a logic error vulnerability in several smartphones.HUAWEI Mate 20;HUAWEI Mate 30 Pro
- CVE-2020-1862There is a double free vulnerability in some Huawei products.CampusInsight;ManageOne
- CVE-2020-10597Delta Industrial Automation DOPSoft, Version 4.00.08.15 and prior.Delta Industrial Automation DOPSoft
- CVE-2020-1696A flaw was found in the all pki-core 10.x.x versions, where Token Processing Service (TPS) where it did not properly sanitize Profile IDs, e[UNKNOWN] pki-core
- CVE-2019-10179A vulnerability was found in all pki-core 10.x.x versions, where the Key Recovery Authority (KRA) Agent Service did not properly sanitize re[UNKNOWN] pki-core/pki-kra
- CVE-2019-10221A Reflected Cross Site Scripting vulnerability was found in all pki-core 10.x.x versions, where the pki-ca module from the pki-core server.[UNKNOWN] pki-core
- CVE-2020-6429Use after free in audio in Google Chrome prior to 80.0.3987.149 allowed a remote attacker to potentially exploit heap corruption via a craftGoogle Chrome
- CVE-2020-6428Use after free in audio in Google Chrome prior to 80.0.3987.149 allowed a remote attacker to potentially exploit heap corruption via a craftGoogle Chrome
- CVE-2020-6427Use after free in audio in Google Chrome prior to 80.0.3987.149 allowed a remote attacker to potentially exploit heap corruption via a craftGoogle Chrome
- CVE-2020-6426Inappropriate implementation in V8 in Google Chrome prior to 80.0.3987.149 allowed a remote attacker to potentially exploit heap corruption Google Chrome
- CVE-2020-6424Use after free in media in Google Chrome prior to 80.0.3987.149 allowed a remote attacker to potentially exploit heap corruption via a craftGoogle Chrome
- CVE-2020-6422Use after free in WebGL in Google Chrome prior to 80.0.3987.149 allowed a remote attacker to potentially exploit heap corruption via a craftGoogle Chrome
- CVE-2020-6420Insufficient policy enforcement in media in Google Chrome prior to 80.0.3987.132 allowed a remote attacker to bypass same origin policy via Google Chrome
- CVE-2020-10682The Filemanager in CMS Made Simple 2.2.13 allows remote code execution via a .php.jpegd JPEG file, as demonstrated by m1_files[] to admin/mo
- CVE-2020-10681The Filemanager in CMS Made Simple 2.2.13 has stored XSS via a .pxd file, as demonstrated by m1_files[] to admin/moduleinterface.php.
- CVE-2019-19484Open redirect via parameter ‘p’ in login.php in Centreon (19.04.4 and below) allows an attacker to craft a payload and execute unintended be
- CVE-2019-19486Local File Inclusion in minPlayCommand.php in Centreon (19.04.4 and below) allows an attacker to traverse paths via a plugin test.
- CVE-2019-19487Command Injection in minPlayCommand.php in Centreon (19.04.4 and below) allows an attacker to achieve command injection via a plugin test.
- CVE-2019-19023Cloud Native Computing Foundation Harbor prior to 1.8.6 and 1.9.3 has a Privilege Escalation Vulnerability in the VMware Harbor Container Regithub.com/goharbor/harbor
- CVE-2020-9345An issue was discovered in signotec signoPAD-API/Web (formerly Websocket Pad Server) before 3.1.1 on Windows.
- CVE-2020-9344Subversion ALM for the enterprise before 8.8.2 allows reflected XSS at multiple locations.
- CVE-2020-9343An issue was discovered in signotec signoPAD-API/Web (formerly Websocket Pad Server) before 3.1.1 on Windows.
- CVE-2019-19029Cloud Native Computing Foundation Harbor prior to 1.8.6 and 1.9.3 allows SQL Injection via user-groups in the VMware Harbor Container Registgithub.com/goharbor/harbor
- CVE-2019-19026Cloud Native Computing Foundation Harbor prior to 1.8.6 and 1.9.3 allows SQL Injection via project quotas in the VMware Harbor Container Reggithub.com/goharbor/harbor
- CVE-2019-19025Cloud Native Computing Foundation Harbor prior to 1.8.6 and 1.9.3 allows CSRF in the VMware Harbor Container Registry for the Pivotal Platfogithub.com/goharbor/harbor
- CVE-2019-18785SuiteCRM 7.10.x prior to 7.10.21 and 7.11.x prior to 7.11.9 mishandles API access tokens and credentials.
- CVE-2019-18782SuiteCRM 7.10.x prior to 7.10.21 and 7.11.x prior to 7.11.9 does not correctly implement the .htaccess protection mechanism.
- CVE-2018-20333An issue was discovered in ASUSWRT 3.0.0.4.384.20308.
- CVE-2018-20335An issue was discovered in ASUSWRT 3.0.0.4.384.20308.
- CVE-2018-20334An issue was discovered in ASUSWRT 3.0.0.4.384.20308.
- CVE-2019-13389RainLoop Webmail before 1.13.0 lacks XSS protection mechanisms such as xlink:href validation, the X-XSS-Protection header, and the Content-S
- CVE-2019-14855A flaw was found in the way certificate signatures could be forged using collisions found in the SHA-1 algorithm.Red Hat gnupg2
- CVE-2020-6449Use after free in audio in Google Chrome prior to 80.0.3987.149 allowed a remote attacker to potentially exploit heap corruption via a craftGoogle Chrome