# CVEs published 2020-03-23

62 CVEs were published on March 23, 2020: 2 critical, 9 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2020-5252](https://cve.now/CVE-2020-5252.md): Malicious package may avoid detection in python auditing (CVSS 5.0, pyupio safety · safety)
- [CVE-2020-1944](https://cve.now/CVE-2020-1944.md): There is a vulnerability in Apache Traffic Server 6.0.0 to 6.2.3, 7.0.0 to 7.1.8, and 8.0.0 to 8.0.5 with a smuggling attack and Transfer-En (no CVSS, Apache Traffic Server)
- [CVE-2020-10875](https://cve.now/CVE-2020-10875.md): Motorola FX9500 devices allow remote attackers to conduct absolute path traversal attacks, as demonstrated by PL/SQL Server Pages files such (no CVSS)
- [CVE-2020-10879](https://cve.now/CVE-2020-10879.md): rConfig before 3.9.5 allows command injection by sending a crafted GET request to lib/crud/search.crud.php since the nodeId parameter is pas (no CVSS)
- [CVE-2019-17559](https://cve.now/CVE-2019-17559.md): There is a vulnerability in Apache Traffic Server 6.0.0 to 6.2.3, 7.0.0 to 7.1.8, and 8.0.0 to 8.0.5 with a smuggling attack and scheme pars (no CVSS, Apache Traffic Server)
- [CVE-2019-17565](https://cve.now/CVE-2019-17565.md): There is a vulnerability in Apache Traffic Server 6.0.0 to 6.2.3, 7.0.0 to 7.1.8, and 8.0.0 to 8.0.5 with a smuggling attack and chunked enc (no CVSS, Apache Traffic Server)
- [CVE-2020-10874](https://cve.now/CVE-2020-10874.md): Motorola FX9500 devices allow remote attackers to read database files. (no CVSS)
- [CVE-2020-8863](https://cve.now/CVE-2020-8863.md): This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of D-Link DIR-867, DIR-878, and DIR- (CVSS 8.8, D-Link Multiple Routers)
- [CVE-2020-8864](https://cve.now/CVE-2020-8864.md): This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of D-Link DIR-867, DIR-878, and DIR- (CVSS 8.8, D-Link Multiple Routers)
- [CVE-2020-8859](https://cve.now/CVE-2020-8859.md): This vulnerability allows remote attackers to create a denial-of-service condition on affected installations of ELOG Electronic Logbook 3.1. (CVSS 5.3, ELOG Electronic Logbook)
- [CVE-2020-6967](https://cve.now/CVE-2020-6967.md): In Rockwell Automation all versions of FactoryTalk Diagnostics software, a subsystem of the FactoryTalk Services Platform, FactoryTalk Diagn (no CVSS, Rockwell Automation All versions of FactoryTalk Diagnostics…)
- [CVE-2020-8868](https://cve.now/CVE-2020-8868.md): This vulnerability allows remote attackers to execute arbitrary code on affected installations of Quest Foglight Evolve 9.0.0. (CVSS 9.8, Quest Foglight Evolve)
- [CVE-2020-8865](https://cve.now/CVE-2020-8865.md): This vulnerability allows remote attackers to execute local PHP files on affected installations of Horde Groupware Webmail Edition 5.2.22. (CVSS 6.3, Horde Groupware Webmail Edition)
- [CVE-2020-8866](https://cve.now/CVE-2020-8866.md): This vulnerability allows remote attackers to create arbitrary files on affected installations of Horde Groupware Webmail Edition 5.2.22. (CVSS 4.3, Horde Groupware Webmail Edition)
- [CVE-2019-6558](https://cve.now/CVE-2019-6558.md): In Auto-Maskin RP210E Versions 3.7 and prior, DCU210E Versions 3.7 and prior and Marine Observer Pro (Android App), the software contains a (no CVSS, Auto-Maskin RP210E Versions 3.7 and prior DCU210E Versions…)
- [CVE-2020-10871](https://cve.now/CVE-2020-10871.md): In OpenWrt LuCI git-20.x, remote unauthenticated attackers can retrieve the list of installed packages and services. (no CVSS)
- [CVE-2019-6560](https://cve.now/CVE-2019-6560.md): In Auto-Maskin RP210E Versions 3.7 and prior, DCU210E Versions 3.7 and prior and Marine Observer Pro (Android App), the software contains a (no CVSS, Auto-Maskin RP210E Versions 3.7 and prior DCU210E Versions…)
- [CVE-2020-5722](https://cve.now/CVE-2020-5722.md): The HTTP interface of the Grandstream UCM6200 series is vulnerable to an unauthenticated remote SQL injection via crafted HTTP request. (CVSS 9.8, KEV, Grandstream UCM6200 Series)
- [CVE-2020-7480](https://cve.now/CVE-2020-7480.md): A CWE-94: Improper Control of Generation of Code ('Code Injection') vulnerability exists in Andover Continuum (All versions), which could ca (no CVSS, Andover Continuum)
- [CVE-2020-7482](https://cve.now/CVE-2020-7482.md): A CWE-79:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability exists Andover Continuum (All ve (no CVSS, Andover Continuum)
- [CVE-2020-7481](https://cve.now/CVE-2020-7481.md): A CWE-79:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability exists Andover Continuum (All ve (no CVSS, Andover Continuum)
- [CVE-2020-7479](https://cve.now/CVE-2020-7479.md): A CWE-306: Missing Authentication for Critical Function vulnerability exists in IGSS (Versions 14 and prior using the service: IGSSupdate), (no CVSS, IGSS (Interactive Graphical SCADA System))
- [CVE-2020-7478](https://cve.now/CVE-2020-7478.md): A CWE-22: Improper Limitation of a Pathname to a Restricted Directory exists in IGSS (Versions 14 and prior using the service: IGSSupdate), (no CVSS, IGSS (Interactive Graphical SCADA System))
- [CVE-2020-7477](https://cve.now/CVE-2020-7477.md): A CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists in Quantum Ethernet Network module 140NOE771x1 (Version (CVSS 7.5, Modicon Quantum Ethernet Network module and Quantum / Premi…)
- [CVE-2020-10870](https://cve.now/CVE-2020-10870.md): Zim through 0.72.1 creates temporary directories with predictable names. (CVSS 5.5)
- [CVE-2020-7476](https://cve.now/CVE-2020-7476.md): A CWE-426: Untrusted Search Path vulnerability exists in ZigBee Installation Kit (Versions prior to 1.0.1), which could cause execution of m (no CVSS, ZigBee Installation Toolkit)
- [CVE-2020-7475](https://cve.now/CVE-2020-7475.md): A CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection'), reflective DLL, vulnerability (no CVSS, EcoStruxure Control Expert (all versions prior to 14.1 Hot…)
- [CVE-2020-7474](https://cve.now/CVE-2020-7474.md): A CWE-427: Uncontrolled Search Path Element vulnerability exists in ProSoft Configurator (v1.002 and prior), for the PMEPXM0100 (H) module, (no CVSS, ProSoft Configurator v1.002 and prior, for the PMEPXM0100 (…)
- [CVE-2020-8876](https://cve.now/CVE-2020-8876.md): This vulnerability allows local attackers to disclose information on affected installations of Parallels Desktop 15.1.2-47123. (CVSS 6.5, Parallels Desktop)
- [CVE-2020-8873](https://cve.now/CVE-2020-8873.md): This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 15.1.2-47123. (CVSS 8.2, Parallels Desktop)
- [CVE-2020-8874](https://cve.now/CVE-2020-8874.md): This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 15.1.2-47123. (CVSS 7.5, Parallels Desktop)
- [CVE-2020-8875](https://cve.now/CVE-2020-8875.md): This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 15.1.2-47123. (CVSS 8.8, Parallels Desktop)
- [CVE-2020-8871](https://cve.now/CVE-2020-8871.md): This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 15.1.0-47107 . (CVSS 8.2, Parallels Desktop)
- [CVE-2020-8872](https://cve.now/CVE-2020-8872.md): This vulnerability allows local attackers to disclose sensitive information on affected installations of Parallels Desktop 15.1.1-47117. (CVSS 6.0, Parallels Desktop)
- [CVE-2019-20627](https://cve.now/CVE-2019-20627.md): AutoUpdater.cs in AutoUpdater.NET before 1.5.8 allows XXE. (no CVSS, Autoupdater.NET.Official)
- [CVE-2020-9392](https://cve.now/CVE-2020-9392.md): An issue was discovered in the pricing-table-by-supsystic plugin before 1.8.2 for WordPress. (CVSS 7.3)
- [CVE-2019-20626](https://cve.now/CVE-2019-20626.md): The remote keyless system on Honda HR-V 2017 vehicles sends the same RF signal for each door-open request, which might allow a replay attack (no CVSS)
- [CVE-2019-19034](https://cve.now/CVE-2019-19034.md): Zoho ManageEngine Asset Explorer 6.5 does not validate the System Center Configuration Manager (SCCM) database username when dynamically gen (no CVSS)
- [CVE-2020-8838](https://cve.now/CVE-2020-8838.md): An issue was discovered in Zoho ManageEngine AssetExplorer 6.5. (no CVSS)
- [CVE-2020-10364](https://cve.now/CVE-2020-10364.md): The SSH daemon on MikroTik routers through v6.44.3 could allow remote attackers to generate CPU activity, trigger refusal of new authorized (no CVSS)
- [CVE-2020-9760](https://cve.now/CVE-2020-9760.md): An issue was discovered in WeeChat before 2.7.1 (0.3.4 to 2.7 are affected). (no CVSS)
- [CVE-2020-9759](https://cve.now/CVE-2020-9759.md): webOS TV Emulator privilege escalation vulnerability (CVSS 4.6)
- [CVE-2020-8511](https://cve.now/CVE-2020-8511.md): In Artica Pandora FMS through 7.42, Web Admin users can execute arbitrary code by uploading a .php file via the File Repository component, a (no CVSS)
- [CVE-2020-7935](https://cve.now/CVE-2020-7935.md): Artica Pandora FMS through 7.42 is vulnerable to remote PHP code execution because of an Unrestricted Upload Of A File With A Dangerous Type (no CVSS)
- [CVE-2020-8497](https://cve.now/CVE-2020-8497.md): In Artica Pandora FMS through 7.42, an unauthenticated attacker can read the chat history. (no CVSS)
- [CVE-2019-4718](https://cve.now/CVE-2019-4718.md): IBM Jazz for Service Management 3.13 is vulnerable to cross-site scripting. (CVSS 5.4, IBM Jazz for Service Management)
- [CVE-2016-11022](https://cve.now/CVE-2016-11022.md): NETGEAR Prosafe WC9500 5.1.0.17, WC7600 5.1.0.17, and WC7520 2.5.0.35 devices allow a remote attacker to execute code with root privileges v (no CVSS)
- [CVE-2020-10793](https://cve.now/CVE-2020-10793.md): CodeIgniter through 4.0.0 allows remote attackers to gain privileges via a modified Email ID to the "Select Role of the User" page. (no CVSS, codeigniter4/framework)
- [CVE-2019-19964](https://cve.now/CVE-2019-19964.md): On NETGEAR GS728TPS devices through 5.3.0.35, a remote attacker having network connectivity to the web-administration panel can access part (no CVSS)
- [CVE-2020-1951](https://cve.now/CVE-2020-1951.md): A carefully crafted or corrupt PSD file can cause an infinite loop in Apache Tika's PSDParser in versions 1.0-1.23. (no CVSS, Apache Tika · org.apache.tika:tika)
- [CVE-2020-6650](https://cve.now/CVE-2020-6650.md): Arbitrary code execution through “Update Manager” Class (CVSS 8.3, Eaton UPS Companion Software)
- [CVE-2019-5185](https://cve.now/CVE-2019-5185.md): An exploitable stack buffer overflow vulnerability vulnerability exists in the iocheckd service "I/O-Check" functionality of WAGO PFC 200. (no CVSS, Wago)
- [CVE-2019-5184](https://cve.now/CVE-2019-5184.md): An exploitable double free vulnerability exists in the iocheckd service "I/O-Check" functionality of WAGO PFC 200. (no CVSS, Wago)
- [CVE-2020-1950](https://cve.now/CVE-2020-1950.md): A carefully crafted or corrupt PSD file can cause excessive memory usage in Apache Tika's PSDParser in versions 1.0-1.23. (no CVSS, Apache Tika · org.apache.tika:tika)
- [CVE-2019-5186](https://cve.now/CVE-2019-5186.md): An exploitable stack buffer overflow vulnerability vulnerability exists in the iocheckd service "I/O-Check" functionality of WAGO PFC 200. (no CVSS, Wago)
- [CVE-2019-15510](https://cve.now/CVE-2019-15510.md): ManageEngine\_DesktopCentral.exe in Zoho ManageEngine Desktop Central 10 allows HTML injection on the user administration page via the descri (no CVSS)
- [CVE-2020-10661](https://cve.now/CVE-2020-10661.md): HashiCorp Vault and Vault Enterprise versions 0.11.0 through 1.3.3 may, under certain circumstances, have existing nested-path policies gran (no CVSS, github.com/hashicorp/vault)
- [CVE-2020-10660](https://cve.now/CVE-2020-10660.md): HashiCorp Vault and Vault Enterprise versions 0.9.0 through 1.3.3 may, under certain circumstances, have an Entity's Group membership inadve (no CVSS, github.com/hashicorp/vault)
- [CVE-2020-6425](https://cve.now/CVE-2020-6425.md): Insufficient policy enforcement in extensions in Google Chrome prior to 80.0.3987.149 allowed an attacker who convinced a user to install a (no CVSS, Google Chrome)
- [CVE-2020-10593](https://cve.now/CVE-2020-10593.md): Tor before 0.3.5.10, 0.4.x before 0.4.1.9, and 0.4.2.x before 0.4.2.7 allows remote attackers to cause a Denial of Service (memory leak), ak (no CVSS)
- [CVE-2020-10592](https://cve.now/CVE-2020-10592.md): Tor before 0.3.5.10, 0.4.x before 0.4.1.9, and 0.4.2.x before 0.4.2.7 allows remote attackers to cause a Denial of Service (CPU consumption) (no CVSS)
- [CVE-2020-9752](https://cve.now/CVE-2020-9752.md): Naver Cloud Explorer before 2.2.2.11 allows the attacker can move a local file in any path on the filesystem as a system privilege through i (no CVSS, Naver Cloud Explorer)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2020-03-23
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.