# CVEs published 2020-03-22

14 CVEs were published on March 22, 2020: 0 critical, 0 high. Days are UTC.

- [CVE-2020-10818](https://cve.now/CVE-2020-10818.md): Artica Proxy 4.26 allows remote command execution for an authenticated user via shell metacharacters in the "Modify the hostname" field. (no CVSS)
- [CVE-2020-10819](https://cve.now/CVE-2020-10819.md): Nagios XI 5.6.11 allows XSS via the includes/components/ldap\_ad\_integration/ username parameter. (no CVSS)
- [CVE-2020-10820](https://cve.now/CVE-2020-10820.md): Nagios XI 5.6.11 allows XSS via the includes/components/ldap\_ad\_integration/ password parameter. (no CVSS)
- [CVE-2020-10821](https://cve.now/CVE-2020-10821.md): Nagios XI 5.6.11 allows XSS via the account/main.php theme parameter. (no CVSS)
- [CVE-2020-10809](https://cve.now/CVE-2020-10809.md): An issue was discovered in HDF5 through 1.12.0. (no CVSS)
- [CVE-2020-10810](https://cve.now/CVE-2020-10810.md): An issue was discovered in HDF5 through 1.12.0. (no CVSS)
- [CVE-2020-10811](https://cve.now/CVE-2020-10811.md): An issue was discovered in HDF5 through 1.12.0. (no CVSS)
- [CVE-2020-10812](https://cve.now/CVE-2020-10812.md): An issue was discovered in HDF5 through 1.12.0. (no CVSS)
- [CVE-2020-10808](https://cve.now/CVE-2020-10808.md): Vesta Control Panel (VestaCP) through 0.9.8-26 allows Command Injection via the schedule/backup Backup Listing Endpoint. (no CVSS)
- [CVE-2020-10807](https://cve.now/CVE-2020-10807.md): auth\_svc in Caldera before 2.6.5 allows authentication bypass (for REST API requests) via a forged "localhost" string in the HTTP Host heade (no CVSS)
- [CVE-2020-10806](https://cve.now/CVE-2020-10806.md): eZ Publish Kernel before 5.4.14.1, 6.x before 6.13.6.2, and 7.x before 7.5.6.2 and eZ Publish Legacy before 5.4.14.1, 2017 before 2017.12.7. (no CVSS, ezsystems/ezpublish-kernel · ezsystems/ezpublish-legacy)
- [CVE-2020-10802](https://cve.now/CVE-2020-10802.md): In phpMyAdmin 4.x before 4.9.5 and 5.x before 5.0.2, a SQL injection vulnerability has been discovered where certain parameters are not prop (no CVSS, phpmyadmin/phpmyadmin)
- [CVE-2020-10803](https://cve.now/CVE-2020-10803.md): In phpMyAdmin 4.x before 4.9.5 and 5.x before 5.0.2, a SQL injection vulnerability was discovered where malicious code could be used to trig (no CVSS, phpmyadmin/phpmyadmin)
- [CVE-2020-10804](https://cve.now/CVE-2020-10804.md): In phpMyAdmin 4.x before 4.9.5 and 5.x before 5.0.2, a SQL injection vulnerability was found in retrieval of the current username (in librar (no CVSS, phpmyadmin/phpmyadmin)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2020-03-22
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.