CVEs published March 23, 2020
62 CVEs were published on March 23, 2020: 2 critical, 9 high. 1 is now in CISA KEV.
- Published
- 62
- Critical
- 2
- High
- 9
- Medium
- 9
- Low
- 0
- Unrated
- 42
- Now in CISA KEV
- 1
- Fix available
- 7
Most affected products
- Parallels Desktop
- 6
- Andover Continuum
- 3
- Apache Traffic Server
- 3
- Wago
- 3
- Apache Tika · org.apache.tika:tika
- 2
- Auto-Maskin RP210E Versions 3.7 and prior DCU210E Versions…
- 2
- D-Link Multiple Routers
- 2
- github.com/hashicorp/vault
- 2
- Horde Groupware Webmail Edition
- 2
- IGSS (Interactive Graphical SCADA System)
- 2
Critical 2
- CVE-2020-8868This vulnerability allows remote attackers to execute arbitrary code on affected installations of Quest Foglight Evolve 9.0.0.Quest Foglight Evolve
- CVE-2020-5722The HTTP interface of the Grandstream UCM6200 series is vulnerable to an unauthenticated remote SQL injection via crafted HTTP request.Grandstream UCM6200 Series
High 9
- CVE-2020-8863This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of D-Link DIR-867, DIR-878, and DIR-D-Link Multiple Routers
- CVE-2020-8864This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of D-Link DIR-867, DIR-878, and DIR-D-Link Multiple Routers
- CVE-2020-7477A CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists in Quantum Ethernet Network module 140NOE771x1 (VersionModicon Quantum Ethernet Network module and Quantum / Premi…
- CVE-2020-8873This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 15.1.2-47123.Parallels Desktop
- CVE-2020-8874This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 15.1.2-47123.Parallels Desktop
- CVE-2020-8875This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 15.1.2-47123.Parallels Desktop
- CVE-2020-8871This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 15.1.0-47107 .Parallels Desktop
- CVE-2020-9392An issue was discovered in the pricing-table-by-supsystic plugin before 1.8.2 for WordPress.
- CVE-2020-6650Arbitrary code execution through “Update Manager” ClassEaton UPS Companion Software
Medium, low and unrated 51
- CVE-2020-5252Malicious package may avoid detection in python auditingpyupio safety · safety
- CVE-2020-1944There is a vulnerability in Apache Traffic Server 6.0.0 to 6.2.3, 7.0.0 to 7.1.8, and 8.0.0 to 8.0.5 with a smuggling attack and Transfer-EnApache Traffic Server
- CVE-2020-10875Motorola FX9500 devices allow remote attackers to conduct absolute path traversal attacks, as demonstrated by PL/SQL Server Pages files such
- CVE-2020-10879rConfig before 3.9.5 allows command injection by sending a crafted GET request to lib/crud/search.crud.php since the nodeId parameter is pas
- CVE-2019-17559There is a vulnerability in Apache Traffic Server 6.0.0 to 6.2.3, 7.0.0 to 7.1.8, and 8.0.0 to 8.0.5 with a smuggling attack and scheme parsApache Traffic Server
- CVE-2019-17565There is a vulnerability in Apache Traffic Server 6.0.0 to 6.2.3, 7.0.0 to 7.1.8, and 8.0.0 to 8.0.5 with a smuggling attack and chunked encApache Traffic Server
- CVE-2020-10874Motorola FX9500 devices allow remote attackers to read database files.
- CVE-2020-8859This vulnerability allows remote attackers to create a denial-of-service condition on affected installations of ELOG Electronic Logbook 3.1.ELOG Electronic Logbook
- CVE-2020-6967In Rockwell Automation all versions of FactoryTalk Diagnostics software, a subsystem of the FactoryTalk Services Platform, FactoryTalk DiagnRockwell Automation All versions of FactoryTalk Diagnostics…
- CVE-2020-8865This vulnerability allows remote attackers to execute local PHP files on affected installations of Horde Groupware Webmail Edition 5.2.22.Horde Groupware Webmail Edition
- CVE-2020-8866This vulnerability allows remote attackers to create arbitrary files on affected installations of Horde Groupware Webmail Edition 5.2.22.Horde Groupware Webmail Edition
- CVE-2019-6558In Auto-Maskin RP210E Versions 3.7 and prior, DCU210E Versions 3.7 and prior and Marine Observer Pro (Android App), the software contains a Auto-Maskin RP210E Versions 3.7 and prior DCU210E Versions…
- CVE-2020-10871In OpenWrt LuCI git-20.x, remote unauthenticated attackers can retrieve the list of installed packages and services.
- CVE-2019-6560In Auto-Maskin RP210E Versions 3.7 and prior, DCU210E Versions 3.7 and prior and Marine Observer Pro (Android App), the software contains a Auto-Maskin RP210E Versions 3.7 and prior DCU210E Versions…
- CVE-2020-7480A CWE-94: Improper Control of Generation of Code ('Code Injection') vulnerability exists in Andover Continuum (All versions), which could caAndover Continuum
- CVE-2020-7482A CWE-79:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability exists Andover Continuum (All veAndover Continuum
- CVE-2020-7481A CWE-79:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability exists Andover Continuum (All veAndover Continuum
- CVE-2020-7479A CWE-306: Missing Authentication for Critical Function vulnerability exists in IGSS (Versions 14 and prior using the service: IGSSupdate), IGSS (Interactive Graphical SCADA System)
- CVE-2020-7478A CWE-22: Improper Limitation of a Pathname to a Restricted Directory exists in IGSS (Versions 14 and prior using the service: IGSSupdate), IGSS (Interactive Graphical SCADA System)
- CVE-2020-10870Zim through 0.72.1 creates temporary directories with predictable names.
- CVE-2020-7476A CWE-426: Untrusted Search Path vulnerability exists in ZigBee Installation Kit (Versions prior to 1.0.1), which could cause execution of mZigBee Installation Toolkit
- CVE-2020-7475A CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection'), reflective DLL, vulnerability EcoStruxure Control Expert (all versions prior to 14.1 Hot…
- CVE-2020-7474A CWE-427: Uncontrolled Search Path Element vulnerability exists in ProSoft Configurator (v1.002 and prior), for the PMEPXM0100 (H) module, ProSoft Configurator v1.002 and prior, for the PMEPXM0100 (…
- CVE-2020-8876This vulnerability allows local attackers to disclose information on affected installations of Parallels Desktop 15.1.2-47123.Parallels Desktop
- CVE-2020-8872This vulnerability allows local attackers to disclose sensitive information on affected installations of Parallels Desktop 15.1.1-47117.Parallels Desktop
- CVE-2019-20627AutoUpdater.cs in AutoUpdater.NET before 1.5.8 allows XXE.Autoupdater.NET.Official
- CVE-2019-20626The remote keyless system on Honda HR-V 2017 vehicles sends the same RF signal for each door-open request, which might allow a replay attack
- CVE-2019-19034Zoho ManageEngine Asset Explorer 6.5 does not validate the System Center Configuration Manager (SCCM) database username when dynamically gen
- CVE-2020-8838An issue was discovered in Zoho ManageEngine AssetExplorer 6.5.
- CVE-2020-10364The SSH daemon on MikroTik routers through v6.44.3 could allow remote attackers to generate CPU activity, trigger refusal of new authorized
- CVE-2020-9760An issue was discovered in WeeChat before 2.7.1 (0.3.4 to 2.7 are affected).
- CVE-2020-9759webOS TV Emulator privilege escalation vulnerability
- CVE-2020-8511In Artica Pandora FMS through 7.42, Web Admin users can execute arbitrary code by uploading a .php file via the File Repository component, a
- CVE-2020-7935Artica Pandora FMS through 7.42 is vulnerable to remote PHP code execution because of an Unrestricted Upload Of A File With A Dangerous Type
- CVE-2020-8497In Artica Pandora FMS through 7.42, an unauthenticated attacker can read the chat history.
- CVE-2019-4718IBM Jazz for Service Management 3.13 is vulnerable to cross-site scripting.IBM Jazz for Service Management
- CVE-2016-11022NETGEAR Prosafe WC9500 5.1.0.17, WC7600 5.1.0.17, and WC7520 2.5.0.35 devices allow a remote attacker to execute code with root privileges v
- CVE-2020-10793CodeIgniter through 4.0.0 allows remote attackers to gain privileges via a modified Email ID to the "Select Role of the User" page.codeigniter4/framework
- CVE-2019-19964On NETGEAR GS728TPS devices through 5.3.0.35, a remote attacker having network connectivity to the web-administration panel can access part
- CVE-2020-1951A carefully crafted or corrupt PSD file can cause an infinite loop in Apache Tika's PSDParser in versions 1.0-1.23.Apache Tika · org.apache.tika:tika
- CVE-2019-5185An exploitable stack buffer overflow vulnerability vulnerability exists in the iocheckd service "I/O-Check" functionality of WAGO PFC 200.Wago
- CVE-2019-5184An exploitable double free vulnerability exists in the iocheckd service "I/O-Check" functionality of WAGO PFC 200.Wago
- CVE-2020-1950A carefully crafted or corrupt PSD file can cause excessive memory usage in Apache Tika's PSDParser in versions 1.0-1.23.Apache Tika · org.apache.tika:tika
- CVE-2019-5186An exploitable stack buffer overflow vulnerability vulnerability exists in the iocheckd service "I/O-Check" functionality of WAGO PFC 200.Wago
- CVE-2019-15510ManageEngine_DesktopCentral.exe in Zoho ManageEngine Desktop Central 10 allows HTML injection on the user administration page via the descri
- CVE-2020-10661HashiCorp Vault and Vault Enterprise versions 0.11.0 through 1.3.3 may, under certain circumstances, have existing nested-path policies grangithub.com/hashicorp/vault
- CVE-2020-10660HashiCorp Vault and Vault Enterprise versions 0.9.0 through 1.3.3 may, under certain circumstances, have an Entity's Group membership inadvegithub.com/hashicorp/vault
- CVE-2020-6425Insufficient policy enforcement in extensions in Google Chrome prior to 80.0.3987.149 allowed an attacker who convinced a user to install a Google Chrome
- CVE-2020-10593Tor before 0.3.5.10, 0.4.x before 0.4.1.9, and 0.4.2.x before 0.4.2.7 allows remote attackers to cause a Denial of Service (memory leak), ak
- CVE-2020-10592Tor before 0.3.5.10, 0.4.x before 0.4.1.9, and 0.4.2.x before 0.4.2.7 allows remote attackers to cause a Denial of Service (CPU consumption)
- CVE-2020-9752Naver Cloud Explorer before 2.2.2.11 allows the attacker can move a local file in any path on the filesystem as a system privilege through iNaver Cloud Explorer