# CVEs published 2020-03-20

78 CVEs were published on March 20, 2020: 1 critical, 7 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2020-10799](https://cve.now/CVE-2020-10799.md): The svglib package through 0.9.3 for Python allows XXE attacks via an svg2rlg call. (no CVSS, svglib)
- [CVE-2019-11574](https://cve.now/CVE-2019-11574.md): An issue was discovered in Simple Machines Forum (SMF) before release 2.0.17. (no CVSS)
- [CVE-2019-13463](https://cve.now/CVE-2019-13463.md): An XSS vulnerability in qcopd-shortcode-generator.php in the Simple Link Directory plugin before 7.3.5 for WordPress allows remote attackers (no CVSS)
- [CVE-2019-16528](https://cve.now/CVE-2019-16528.md): An issue was discovered in the AbuseFilter extension for MediaWiki. (no CVSS)
- [CVE-2019-18641](https://cve.now/CVE-2019-18641.md): Rock RMS before 1.8.6 mishandles vCard access control within the People/GetVCard/REST controller. (no CVSS)
- [CVE-2019-18860](https://cve.now/CVE-2019-18860.md): Squid before 4.9, when certain web browsers are used, mishandles HTML in the host (aka hostname) parameter to cachemgr.cgi. (no CVSS)
- [CVE-2020-10194](https://cve.now/CVE-2020-10194.md): cs/service/account/AutoCompleteGal.java in Zimbra zm-mailbox before 8.8.15.p8 allows authenticated users to request any GAL account. (no CVSS)
- [CVE-2019-15522](https://cve.now/CVE-2019-15522.md): An issue was discovered in LINBIT csync2 through 2.0. (no CVSS)
- [CVE-2020-8140](https://cve.now/CVE-2020-8140.md): A code injection in Nextcloud Desktop Client 2.6.2 for macOS allowed to load arbitrary code when starting the client with DYLD\_INSERT\_LIBRAR (no CVSS, Desktop Client)
- [CVE-2020-8139](https://cve.now/CVE-2020-8139.md): A missing access control check in Nextcloud Server \< 18.0.1, \< 17.0.4, and \< 16.0.9 causes hide-download shares to be downloadable when appe (no CVSS, Nextcloud Server)
- [CVE-2020-8138](https://cve.now/CVE-2020-8138.md): A missing check for IPv4 nested inside IPv6 in Nextcloud server \< 17.0.1, \< 16.0.7, and \< 15.0.14 allowed a Server-Side Request Forgery (SSR (no CVSS, Nextcloud Server)
- [CVE-2020-8883](https://cve.now/CVE-2020-8883.md): This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit Studio Photo 3.6.6.916. (CVSS 3.3, Foxit Studio Photo)
- [CVE-2020-8880](https://cve.now/CVE-2020-8880.md): This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Studio Photo 3.6.6.916. (CVSS 7.8, Foxit Studio Photo)
- [CVE-2020-8881](https://cve.now/CVE-2020-8881.md): This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Studio Photo 3.6.6.916. (CVSS 7.8, Foxit Studio Photo)
- [CVE-2020-8882](https://cve.now/CVE-2020-8882.md): This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Studio Photo 3.6.6.916. (CVSS 7.8, Foxit Studio Photo)
- [CVE-2020-8878](https://cve.now/CVE-2020-8878.md): This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Studio Photo 3.6.6.916. (CVSS 7.8, Foxit Studio Photo)
- [CVE-2020-8879](https://cve.now/CVE-2020-8879.md): This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit Studio Photo 3.6.6.916. (CVSS 3.3, Foxit Studio Photo)
- [CVE-2020-8877](https://cve.now/CVE-2020-8877.md): This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit Studio Photo 3.6.6.916. (CVSS 3.3, Foxit Studio Photo)
- [CVE-2019-12498](https://cve.now/CVE-2019-12498.md): The WP Live Chat Support plugin before 8.0.33 for WordPress accepts certain REST API calls without invoking the wplc\_api\_permission\_check pr (no CVSS)
- [CVE-2020-8134](https://cve.now/CVE-2020-8134.md): Server-side request forgery (SSRF) vulnerability in Ghost CMS \< 3.10.0 allows an attacker to scan local or external network or otherwise int (no CVSS, Ghost)
- [CVE-2020-8137](https://cve.now/CVE-2020-8137.md): Code injection vulnerability in blamer 1.0.0 and earlier may result in remote code execution when the input can be controlled by an attacker (no CVSS, blamer)
- [CVE-2020-8135](https://cve.now/CVE-2020-8135.md): The uppy npm package \< 1.9.3 is vulnerable to a Server-Side Request Forgery (SSRF) vulnerability, which allows an attacker to scan local or (no CVSS, uppy · @uppy/companion)
- [CVE-2020-8136](https://cve.now/CVE-2020-8136.md): Prototype pollution vulnerability in fastify-multipart \< 1.0.5 allows an attacker to crash fastify applications parsing multipart requests b (no CVSS, fastify-multipart)
- [CVE-2020-7961](https://cve.now/CVE-2020-7961.md): Deserialization of Untrusted Data in Liferay Portal prior to 7.2.1 CE GA2 allows remote attackers to execute arbitrary code via JSON web ser (CVSS 9.8, KEV, com.liferay.portal:com.liferay.portal.kernel)
- [CVE-2020-10558](https://cve.now/CVE-2020-10558.md): The driving interface of Tesla Model 3 vehicles in any release before 2020.4.10 allows Denial of Service to occur due to improper process se (no CVSS)
- [CVE-2020-10792](https://cve.now/CVE-2020-10792.md): openITCOCKPIT through 3.7.2 allows remote attackers to configure the self::DEVELOPMENT or self::STAGING option by placing a hostname contain (no CVSS)
- [CVE-2020-9425](https://cve.now/CVE-2020-9425.md): An issue was discovered in includes/head.inc.php in rConfig before 3.9.4. (no CVSS)
- [CVE-2019-19324](https://cve.now/CVE-2019-19324.md): Xmidt cjwt through 1.0.1 before 2019-11-25 maps unsupported algorithms to alg=none, which sometimes leads to untrusted accidental JWT accept (no CVSS)
- [CVE-2019-15665](https://cve.now/CVE-2019-15665.md): An issue was discovered in Rivet Killer Control Center before 2.1.1352. (no CVSS)
- [CVE-2019-19148](https://cve.now/CVE-2019-19148.md): Tellabs Optical Line Terminal (OLT) 1150 devices allow Remote Command Execution via the -l option to TELNET or SSH. (no CVSS)
- [CVE-2019-15664](https://cve.now/CVE-2019-15664.md): An issue was discovered in Rivet Killer Control Center before 2.1.1352. (no CVSS)
- [CVE-2019-15663](https://cve.now/CVE-2019-15663.md): An issue was discovered in Rivet Killer Control Center before 2.1.1352. (no CVSS)
- [CVE-2019-16258](https://cve.now/CVE-2019-16258.md): The bootloader of the homee Brain Cube V2 through 2.23.0 allows attackers with physical access to gain root access by manipulating the U-Boo (no CVSS)
- [CVE-2019-15075](https://cve.now/CVE-2019-15075.md): An issue was discovered in iNextrix ASTPP before 4.0.1. (no CVSS)
- [CVE-2019-15662](https://cve.now/CVE-2019-15662.md): An issue was discovered in Rivet Killer Control Center before 2.1.1352. (no CVSS)
- [CVE-2019-15661](https://cve.now/CVE-2019-15661.md): An issue was discovered in Rivet Killer Control Center before 2.1.1352. (no CVSS)
- [CVE-2020-1879](https://cve.now/CVE-2020-1879.md): There is an improper integrity checking vulnerability on some huawei products. (no CVSS, HEGE-560;HEGE-570;OSCA-550;OSCA-550A;OSCA-550AX;OSCA-550X)
- [CVE-2020-1794](https://cve.now/CVE-2020-1794.md): There is an improper authentication vulnerability in several smartphones. (no CVSS, HUAWEI Mate 20;HUAWEI Mate 30 Pro)
- [CVE-2020-1864](https://cve.now/CVE-2020-1864.md): Some Huawei products have a security vulnerability due to improper authentication. (no CVSS, Secospace AntiDDoS8000)
- [CVE-2020-1793](https://cve.now/CVE-2020-1793.md): There is an improper authentication vulnerability in several smartphones. (no CVSS, HUAWEI Mate 20;HUAWEI Mate 30 Pro)
- [CVE-2020-1796](https://cve.now/CVE-2020-1796.md): There is an improper authorization vulnerability in several smartphones. (no CVSS, HUAWEI Mate 20;HUAWEI Mate 30 Pro)
- [CVE-2020-1878](https://cve.now/CVE-2020-1878.md): Huawei smartphone OxfordS-AN00A with versions earlier than 10.0.1.152D(C735E152R3P3),versions earlier than 10.0.1.160(C00E160R4P1) have an i (no CVSS, OxfordS-AN00A)
- [CVE-2020-1795](https://cve.now/CVE-2020-1795.md): There is a logic error vulnerability in several smartphones. (no CVSS, HUAWEI Mate 20;HUAWEI Mate 30 Pro)
- [CVE-2020-1862](https://cve.now/CVE-2020-1862.md): There is a double free vulnerability in some Huawei products. (no CVSS, CampusInsight;ManageOne)
- [CVE-2020-10597](https://cve.now/CVE-2020-10597.md): Delta Industrial Automation DOPSoft, Version 4.00.08.15 and prior. (no CVSS, Delta Industrial Automation DOPSoft)
- [CVE-2019-19345](https://cve.now/CVE-2019-19345.md): A vulnerability was found in all openshift/mediawiki-apb 4.x.x versions prior to 4.3.0, where an insecure modification vulnerability in the (CVSS 7.0, \[UNKNOWN\] openshift/mediawiki-apb)
- [CVE-2020-1696](https://cve.now/CVE-2020-1696.md): A flaw was found in the all pki-core 10.x.x versions, where Token Processing Service (TPS) where it did not properly sanitize Profile IDs, e (CVSS 4.6, \[UNKNOWN\] pki-core)
- [CVE-2019-10179](https://cve.now/CVE-2019-10179.md): A vulnerability was found in all pki-core 10.x.x versions, where the Key Recovery Authority (KRA) Agent Service did not properly sanitize re (CVSS 4.3, \[UNKNOWN\] pki-core/pki-kra)
- [CVE-2019-10221](https://cve.now/CVE-2019-10221.md): A Reflected Cross Site Scripting vulnerability was found in all pki-core 10.x.x versions, where the pki-ca module from the pki-core server. (CVSS 4.3, \[UNKNOWN\] pki-core)
- [CVE-2020-6429](https://cve.now/CVE-2020-6429.md): Use after free in audio in Google Chrome prior to 80.0.3987.149 allowed a remote attacker to potentially exploit heap corruption via a craft (no CVSS, Google Chrome)
- [CVE-2020-6428](https://cve.now/CVE-2020-6428.md): Use after free in audio in Google Chrome prior to 80.0.3987.149 allowed a remote attacker to potentially exploit heap corruption via a craft (no CVSS, Google Chrome)
- [CVE-2020-6427](https://cve.now/CVE-2020-6427.md): Use after free in audio in Google Chrome prior to 80.0.3987.149 allowed a remote attacker to potentially exploit heap corruption via a craft (no CVSS, Google Chrome)
- [CVE-2020-6426](https://cve.now/CVE-2020-6426.md): Inappropriate implementation in V8 in Google Chrome prior to 80.0.3987.149 allowed a remote attacker to potentially exploit heap corruption (no CVSS, Google Chrome)
- [CVE-2020-6424](https://cve.now/CVE-2020-6424.md): Use after free in media in Google Chrome prior to 80.0.3987.149 allowed a remote attacker to potentially exploit heap corruption via a craft (no CVSS, Google Chrome)
- [CVE-2020-6422](https://cve.now/CVE-2020-6422.md): Use after free in WebGL in Google Chrome prior to 80.0.3987.149 allowed a remote attacker to potentially exploit heap corruption via a craft (no CVSS, Google Chrome)
- [CVE-2020-6420](https://cve.now/CVE-2020-6420.md): Insufficient policy enforcement in media in Google Chrome prior to 80.0.3987.132 allowed a remote attacker to bypass same origin policy via (no CVSS, Google Chrome)
- [CVE-2020-10682](https://cve.now/CVE-2020-10682.md): The Filemanager in CMS Made Simple 2.2.13 allows remote code execution via a .php.jpegd JPEG file, as demonstrated by m1\_files\[\] to admin/mo (no CVSS)
- [CVE-2020-10681](https://cve.now/CVE-2020-10681.md): The Filemanager in CMS Made Simple 2.2.13 has stored XSS via a .pxd file, as demonstrated by m1\_files\[\] to admin/moduleinterface.php. (no CVSS)
- [CVE-2019-19484](https://cve.now/CVE-2019-19484.md): Open redirect via parameter ‘p’ in login.php in Centreon (19.04.4 and below) allows an attacker to craft a payload and execute unintended be (no CVSS)
- [CVE-2019-19486](https://cve.now/CVE-2019-19486.md): Local File Inclusion in minPlayCommand.php in Centreon (19.04.4 and below) allows an attacker to traverse paths via a plugin test. (no CVSS)
- [CVE-2019-19487](https://cve.now/CVE-2019-19487.md): Command Injection in minPlayCommand.php in Centreon (19.04.4 and below) allows an attacker to achieve command injection via a plugin test. (no CVSS)
- [CVE-2019-19023](https://cve.now/CVE-2019-19023.md): Cloud Native Computing Foundation Harbor prior to 1.8.6 and 1.9.3 has a Privilege Escalation Vulnerability in the VMware Harbor Container Re (no CVSS, github.com/goharbor/harbor)
- [CVE-2020-9345](https://cve.now/CVE-2020-9345.md): An issue was discovered in signotec signoPAD-API/Web (formerly Websocket Pad Server) before 3.1.1 on Windows. (no CVSS)
- [CVE-2020-9344](https://cve.now/CVE-2020-9344.md): Subversion ALM for the enterprise before 8.8.2 allows reflected XSS at multiple locations. (no CVSS)
- [CVE-2020-9343](https://cve.now/CVE-2020-9343.md): An issue was discovered in signotec signoPAD-API/Web (formerly Websocket Pad Server) before 3.1.1 on Windows. (no CVSS)
- [CVE-2019-19029](https://cve.now/CVE-2019-19029.md): Cloud Native Computing Foundation Harbor prior to 1.8.6 and 1.9.3 allows SQL Injection via user-groups in the VMware Harbor Container Regist (no CVSS, github.com/goharbor/harbor)
- [CVE-2019-19026](https://cve.now/CVE-2019-19026.md): Cloud Native Computing Foundation Harbor prior to 1.8.6 and 1.9.3 allows SQL Injection via project quotas in the VMware Harbor Container Reg (no CVSS, github.com/goharbor/harbor)
- [CVE-2019-19025](https://cve.now/CVE-2019-19025.md): Cloud Native Computing Foundation Harbor prior to 1.8.6 and 1.9.3 allows CSRF in the VMware Harbor Container Registry for the Pivotal Platfo (no CVSS, github.com/goharbor/harbor)
- [CVE-2019-18785](https://cve.now/CVE-2019-18785.md): SuiteCRM 7.10.x prior to 7.10.21 and 7.11.x prior to 7.11.9 mishandles API access tokens and credentials. (no CVSS)
- [CVE-2019-18782](https://cve.now/CVE-2019-18782.md): SuiteCRM 7.10.x prior to 7.10.21 and 7.11.x prior to 7.11.9 does not correctly implement the .htaccess protection mechanism. (no CVSS)
- [CVE-2018-20333](https://cve.now/CVE-2018-20333.md): An issue was discovered in ASUSWRT 3.0.0.4.384.20308. (no CVSS)
- [CVE-2018-20335](https://cve.now/CVE-2018-20335.md): An issue was discovered in ASUSWRT 3.0.0.4.384.20308. (no CVSS)
- [CVE-2018-20334](https://cve.now/CVE-2018-20334.md): An issue was discovered in ASUSWRT 3.0.0.4.384.20308. (no CVSS)
- [CVE-2019-13389](https://cve.now/CVE-2019-13389.md): RainLoop Webmail before 1.13.0 lacks XSS protection mechanisms such as xlink:href validation, the X-XSS-Protection header, and the Content-S (no CVSS)
- [CVE-2019-14855](https://cve.now/CVE-2019-14855.md): A flaw was found in the way certificate signatures could be forged using collisions found in the SHA-1 algorithm. (CVSS 5.3, Red Hat gnupg2)
- [CVE-2020-1707](https://cve.now/CVE-2020-1707.md): A vulnerability was found in all openshift/postgresql-apb 4.x.x versions prior to 4.3.0, where an insecure modification vulnerability in the (CVSS 7.0, \[UNKNOWN\] openshift/postgresql-apb)
- [CVE-2020-1709](https://cve.now/CVE-2020-1709.md): A vulnerability was found in all openshift/mediawiki 4.x.x versions prior to 4.3.0, where an insecure modification vulnerability in the /etc (CVSS 7.0, \[UNKNOWN\] openshift/mediawiki)
- [CVE-2020-6449](https://cve.now/CVE-2020-6449.md): Use after free in audio in Google Chrome prior to 80.0.3987.149 allowed a remote attacker to potentially exploit heap corruption via a craft (no CVSS, Google Chrome)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2020-03-20
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.