CVEs published March 25, 2020
109 CVEs were published on March 25, 2020: 1 critical, 8 high.
- Published
- 109
- Critical
- 1
- High
- 8
- Medium
- 6
- Low
- 0
- Unrated
- 94
- Now in CISA KEV
- 0
- Fix available
- 31
Most affected products
- Adobe Photoshop
- 22
- Adobe Acrobat and Reader
- 13
- TP-Link Archer A7
- 8
- Mozilla Thunderbird · Mozilla Firefox
- 6
- Mozilla Firefox
- 5
- Jenkins project Jenkins · org.jenkins-ci.main:jenkins-core
- 4
- EKAKIN Shihonkanri Plus GOOUT
- 3
- Adobe Bridge
- 2
- Adobe ColdFusion
- 2
- CutePHP.com CuteNews
- 2
Critical 1
High 8
- CVE-2020-10887This vulnerability allows a firewall bypass on affected installations of TP-Link Archer A7 Firmware Ver: 190726 AC1750 routers.TP-Link Archer A7
- CVE-2020-10885This vulnerability allows remote attackers to execute arbitrary code on affected installations of TP-Link Archer A7 Firmware Ver: 190726 AC1TP-Link Archer A7
- CVE-2020-10886This vulnerability allows remote attackers to execute arbitrary code on affected installations of TP-Link Archer A7 Firmware Ver: 190726 AC1TP-Link Archer A7
- CVE-2020-10884This vulnerability allows network-adjacent attackers execute arbitrary code on affected installations of TP-Link Archer A7 Firmware Ver: 190TP-Link Archer A7
- CVE-2020-10882This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of TP-Link Archer A7 Firmware Ver: TP-Link Archer A7
- CVE-2020-5282arbitrary shell execution in Nick Chan BotNick Chan nickchanbot
- CVE-2020-5280Local file inclusion vulnerability in http4shttp4s · org.http4s:http4s-server_2.12
- CVE-2020-5261Missing Token Replay DetectionSustainsys Saml2 · Sustainsys.Saml2
Medium, low and unrated 100
- CVE-2020-10965Teradici PCoIP Management Console 20.01.0 and 19.11.1 is vulnerable to unauthenticated password resets via login/resetadminpassword of the d
- CVE-2020-10966In the Password Reset Module in VESTA Control Panel through 0.9.8-25 and Hestia Control Panel before 1.1.1, Host header manipulation leads t
- CVE-2020-10964Serendipity before 2.3.4 on Windows allows remote attackers to execute arbitrary code because the filename of a renamed file may end with a
- CVE-2020-10963FrozenNode Laravel-Administrator through 5.0.12 allows unrestricted file upload (and consequently Remote Code Execution) via admin/tips_imagfrozennode/administrator
- CVE-2020-6805When removing data about an origin whose tab was recently closed, a use-after-free could occur in the Quota manager, resulting in a potentiaMozilla Thunderbird · Mozilla Firefox
- CVE-2020-6806By carefully crafting promise resolutions, it was possible to cause an out-of-bounds read off the end of an array resized during script execMozilla Thunderbird · Mozilla Firefox
- CVE-2020-6807When a device was changed while a stream was about to be destroyed, the <code>stream-reinit</code> task may have been executed after the strMozilla Thunderbird · Mozilla Firefox
- CVE-2020-6808When a JavaScript URL (javascript:) is evaluated and the result is a string, this string is parsed to create an HTML document, which is thenMozilla Firefox
- CVE-2020-6809When a Web Extension had the all-urls permission and made a fetch request with a mode set to 'same-origin', it was possible for the Web ExteMozilla Firefox
- CVE-2020-6810After a website had entered fullscreen mode, it could have used a previously opened popup to obscure the notification that indicates the broMozilla Firefox
- CVE-2020-6811The 'Copy as cURL' feature of Devtools' network tab did not properly escape the HTTP method of a request, which can be controlled by the webMozilla Thunderbird · Mozilla Firefox
- CVE-2020-6812The first time AirPods are connected to an iPhone, they become named after the user's name by default (e.g.Mozilla Thunderbird · Mozilla Firefox
- CVE-2020-6813When protecting CSS blocks with the nonce feature of Content Security Policy, the @import statement in the CSS block could allow an attackerMozilla Firefox
- CVE-2020-6814Mozilla developers reported memory safety bugs present in Firefox and Thunderbird 68.5.Mozilla Thunderbird · Mozilla Firefox
- CVE-2020-6815Mozilla developers reported memory safety and script safety bugs present in Firefox 73.Mozilla Firefox
- CVE-2020-5340RSA Authentication Manager versions prior to 8.4 P10 contain a stored cross-site scripting vulnerability in the Security Console.Dell RSA Authentication Manager
- CVE-2020-5339RSA Authentication Manager versions prior to 8.4 P10 contain a stored cross-site scripting vulnerability in the Security Console.Dell RSA Authentication Manager
- CVE-2020-9520A stored XSS vulnerability was discovered in Micro Focus Vibe, affecting all Vibe version prior to 4.0.7.Micro Focus International Micro Focus Vibe.
- CVE-2020-3776Adobe Photoshop CC 2019 versions 20.0.8 and earlier, and Photoshop 2020 versions 21.1 and earlier have a buffer errors vulnerability.Adobe Photoshop
- CVE-2020-3777Adobe Photoshop CC 2019 versions 20.0.8 and earlier, and Photoshop 2020 versions 21.1 and earlier have an out-of-bounds read vulnerability.Adobe Photoshop
- CVE-2020-3778Adobe Photoshop versions Photoshop CC 2019, and Photoshop 2020 have an out-of-bounds read vulnerability.Adobe Photoshop
- CVE-2020-3788Adobe Photoshop CC 2019 versions 20.0.8 and earlier, and Photoshop 2020 versions 21.1 and earlier have a memory corruption vulnerability.Adobe Photoshop
- CVE-2020-3771Adobe Photoshop CC 2019 versions 20.0.8 and earlier, and Photoshop 2020 versions 21.1 and earlier have an out-of-bounds read vulnerability.Adobe Photoshop
- CVE-2020-3779Adobe Photoshop CC 2019 versions 20.0.8 and earlier, and Photoshop 2020 versions 21.1 and earlier have an out-of-bounds write vulnerability.Adobe Photoshop
- CVE-2020-3790Adobe Photoshop CC 2019 versions 20.0.8 and earlier, and Photoshop 2020 versions 21.1 and earlier have a memory corruption vulnerability.Adobe Photoshop
- CVE-2020-3775Adobe Photoshop CC 2019 versions 20.0.8 and earlier, and Photoshop 2020 versions 21.1 and earlier have a buffer errors vulnerability.Adobe Photoshop
- CVE-2020-3791Adobe Photoshop CC 2019 versions 20.0.8 and earlier, and Photoshop 2020 versions 21.1 and earlier have an out-of-bounds read vulnerability.Adobe Photoshop
- CVE-2020-3774Adobe Photoshop CC 2019 versions 20.0.8 and earlier, and Photoshop 2020 versions 21.1 and earlier have a buffer errors vulnerability.Adobe Photoshop
- CVE-2020-3789Adobe Photoshop CC 2019 versions 20.0.8 and earlier, and Photoshop 2020 versions 21.1 and earlier have a memory corruption vulnerability.Adobe Photoshop
- CVE-2020-3773Adobe Photoshop CC 2019 versions 20.0.8 and earlier, and Photoshop 2020 versions 21.1 and earlier have an out-of-bounds write vulnerability.Adobe Photoshop
- CVE-2020-3781Adobe Photoshop CC 2019 versions 20.0.8 and earlier, and Photoshop 2020 versions 21.1 and earlier have an out-of-bounds read vulnerability.Adobe Photoshop
- CVE-2020-3772Adobe Photoshop CC 2019 versions 20.0.8 and earlier, and Photoshop 2020 versions 21.1 and earlier have a buffer errors vulnerability.Adobe Photoshop
- CVE-2020-3785Adobe Photoshop CC 2019 versions 20.0.8 and earlier, and Photoshop 2020 versions 21.1 and earlier have a memory corruption vulnerability.Adobe Photoshop
- CVE-2020-3784Adobe Photoshop CC 2019 versions 20.0.8 and earlier, and Photoshop 2020 versions 21.1 and earlier have a memory corruption vulnerability.Adobe Photoshop
- CVE-2020-3780Adobe Photoshop CC 2019 versions 20.0.8 and earlier, and Photoshop 2020 versions 21.1 and earlier have a buffer errors vulnerability.Adobe Photoshop
- CVE-2020-3783Adobe Photoshop CC 2019 versions 20.0.8 and earlier, and Photoshop 2020 versions 21.1 and earlier have a heap corruption vulnerability.Adobe Photoshop
- CVE-2020-3787Adobe Photoshop CC 2019 versions 20.0.8 and earlier, and Photoshop 2020 versions 21.1 and earlier have a memory corruption vulnerability.Adobe Photoshop
- CVE-2020-3782Adobe Photoshop CC 2019 versions 20.0.8 and earlier, and Photoshop 2020 versions 21.1 and earlier have an out-of-bounds read vulnerability.Adobe Photoshop
- CVE-2020-3770Adobe Photoshop CC 2019 versions 20.0.8 and earlier, and Photoshop 2020 versions 21.1 and earlier have a buffer errors vulnerability.Adobe Photoshop
- CVE-2020-3786Adobe Photoshop CC 2019 versions 20.0.8 and earlier, and Photoshop 2020 versions 21.1 and earlier have a memory corruption vulnerability.Adobe Photoshop
- CVE-2020-10888This vulnerability allows remote attackers to bypass authentication on affected installations of TP-Link Archer A7 Firmware Ver: 190726 AC17TP-Link Archer A7
- CVE-2020-10883This vulnerability allows local attackers to escalate privileges on affected installations of TP-Link Archer A7 Firmware Ver: 190726 AC1750 TP-Link Archer A7
- CVE-2020-3808Creative Cloud Desktop Application versions 5.0 and earlier have a time-of-check to time-of-use (toctou) race condition vulnerability.Adobe Creative Cloud Desktop Application
- CVE-2020-3794ColdFusion versions ColdFusion 2016, and ColdFusion 2018 have a file inclusion vulnerability.Adobe ColdFusion
- CVE-2020-3761ColdFusion versions ColdFusion 2016, and ColdFusion 2018 have a remote file read vulnerability.Adobe ColdFusion
- CVE-2020-9552Adobe Bridge versions 10.0 have a heap-based buffer overflow vulnerability.Adobe Bridge
- CVE-2020-9551Adobe Bridge versions 10.0 have an out-of-bounds write vulnerability.Adobe Bridge
- CVE-2020-3769Adobe Experience Manager versions 6.5 and earlier have a server-side request forgery (ssrf) vulnerability.Adobe Experience Manager
- CVE-2020-5277Reflected XSS with url_name parameter of PrestaShop module ps_facetedsearchPrestaShop ps_facetedsearch
- CVE-2020-5281LDAP connector injection in PerunCESNET perun
- CVE-2020-3766Adobe Genuine Integrity Service versions Version 6.4 and earlier have an insecure file permissions vulnerability.Adobe Genuine Integrity Service
- CVE-2020-3803Adobe Acrobat and Reader versions 2020.006.20034 and earlier, 2017.011.30158 and earlier, 2017.011.30158 and earlier, 2015.006.30510 and earAdobe Acrobat and Reader
- CVE-2020-3807Adobe Acrobat and Reader versions 2020.006.20034 and earlier, 2017.011.30158 and earlier, 2017.011.30158 and earlier, 2015.006.30510 and earAdobe Acrobat and Reader
- CVE-2020-3804Adobe Acrobat and Reader versions 2020.006.20034 and earlier, 2017.011.30158 and earlier, 2017.011.30158 and earlier, 2015.006.30510 and earAdobe Acrobat and Reader
- CVE-2020-3806Adobe Acrobat and Reader versions 2020.006.20034 and earlier, 2017.011.30158 and earlier, 2017.011.30158 and earlier, 2015.006.30510 and earAdobe Acrobat and Reader
- CVE-2020-3802Adobe Acrobat and Reader versions 2020.006.20034 and earlier, 2017.011.30158 and earlier, 2017.011.30158 and earlier, 2015.006.30510 and earAdobe Acrobat and Reader
- CVE-2020-3805Adobe Acrobat and Reader versions 2020.006.20034 and earlier, 2017.011.30158 and earlier, 2017.011.30158 and earlier, 2015.006.30510 and earAdobe Acrobat and Reader
- CVE-2020-3801Adobe Acrobat and Reader versions 2020.006.20034 and earlier, 2017.011.30158 and earlier, 2017.011.30158 and earlier, 2015.006.30510 and earAdobe Acrobat and Reader
- CVE-2020-3800Adobe Acrobat and Reader versions 2020.006.20034 and earlier, 2017.011.30158 and earlier, 2017.011.30158 and earlier, 2015.006.30510 and earAdobe Acrobat and Reader
- CVE-2019-18626Harris Ormed Self Service before 2019.1.4 allows an authenticated user to view W-2 forms belonging to other users via an arbitrary empNo val
- CVE-2019-7630An issue was discovered in gdrv.sys in Gigabyte APP Center before 19.0227.1.
- CVE-2019-7244An issue was discovered in kerneld.sys in AIDA64 before 5.99.
- CVE-2019-7240An issue was discovered in WinRing0x64.sys in Moo0 System Monitor 1.83.
- CVE-2019-20633GNU patch through 2.7.6 contains a free(p_line[p_end]) Double Free vulnerability in the function another_hunk in pch.c that can cause a deni
- CVE-2019-7245An issue was discovered in GPU-Z.sys in TechPowerUp GPU-Z before 2.23.0.
- CVE-2020-10649DevActSvc.exe in ASUS Device Activation before 1.0.7.0 for Windows 10 notebooks and PCs could lead to unsigned code execution with no additi
- CVE-2020-2171Jenkins RapidDeploy Plugin 4.2 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.Jenkins project Jenkins RapidDeploy Plugin · org.jenkins-ci…
- CVE-2020-2169A form validation endpoint in Jenkins Queue cleanup Plugin 1.3 and earlier does not properly escape a query parameter displayed in an error Jenkins project Jenkins Queue cleanup Plugin · org.jenkins-…
- CVE-2020-2170Jenkins RapidDeploy Plugin 4.2 and earlier does not escape package names in the table of packages obtained from a remote server, resulting iJenkins project Jenkins RapidDeploy Plugin · org.jenkins-ci…
- CVE-2020-2166Jenkins Pipeline: AWS Steps Plugin 1.40 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types, resuJenkins project Jenkins Pipeline: AWS Steps Plugin · de.tai…
- CVE-2020-2167Jenkins OpenShift Pipeline Plugin 1.0.56 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types, resJenkins project Jenkins OpenShift Pipeline Plugin · com.ope…
- CVE-2020-2168Jenkins Azure Container Service Plugin 1.0.1 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types,Jenkins project Jenkins Azure Container Service Plugin · or…
- CVE-2020-2164Jenkins Artifactory Plugin 3.5.0 and earlier stores its Artifactory server password unencrypted in its global configuration file on the JenkJenkins project Jenkins Artifactory Plugin · org.jenkins-ci…
- CVE-2020-2165Jenkins Artifactory Plugin 3.6.0 and earlier transmits configured passwords in plain text as part of its global Jenkins configuration form, Jenkins project Jenkins Artifactory Plugin · org.jenkins-ci…
- CVE-2020-2162Jenkins 2.227 and earlier, LTS 2.204.5 and earlier does not set Content-Security-Policy headers for files uploaded as file parameters to a bJenkins project Jenkins · org.jenkins-ci.main:jenkins-core
- CVE-2020-2163Jenkins 2.227 and earlier, LTS 2.204.5 and earlier improperly processes HTML content of list view column headers, resulting in a stored XSS Jenkins project Jenkins · org.jenkins-ci.main:jenkins-core
- CVE-2020-2160Jenkins 2.227 and earlier, LTS 2.204.5 and earlier uses different representations of request URL paths, which allows attackers to craft URLsJenkins project Jenkins · org.jenkins-ci.main:jenkins-core
- CVE-2020-2161Jenkins 2.227 and earlier, LTS 2.204.5 and earlier does not properly escape node labels that are shown in the form validation for label exprJenkins project Jenkins · org.jenkins-ci.main:jenkins-core
- CVE-2020-3797Adobe Acrobat and Reader versions 2020.006.20034 and earlier, 2017.011.30158 and earlier, 2017.011.30158 and earlier, 2015.006.30510 and earAdobe Acrobat and Reader
- CVE-2020-3799Adobe Acrobat and Reader versions 2020.006.20034 and earlier, 2017.011.30158 and earlier, 2017.011.30158 and earlier, 2015.006.30510 and earAdobe Acrobat and Reader
- CVE-2020-3795Adobe Acrobat and Reader versions 2020.006.20034 and earlier, 2017.011.30158 and earlier, 2017.011.30158 and earlier, 2015.006.30510 and earAdobe Acrobat and Reader
- CVE-2020-3793Adobe Acrobat and Reader versions 2020.006.20034 and earlier, 2017.011.30158 and earlier, 2017.011.30158 and earlier, 2015.006.30510 and earAdobe Acrobat and Reader
- CVE-2020-3792Adobe Acrobat and Reader versions 2020.006.20034 and earlier, 2017.011.30158 and earlier, 2017.011.30158 and earlier, 2015.006.30510 and earAdobe Acrobat and Reader
- CVE-2020-1957Apache Shiro before 1.5.2, when using Apache Shiro with Spring dynamic controllers, a specially crafted request may cause an authentication Apache Shiro · org.apache.shiro:shiro-core
- CVE-2019-19127An authentication bypass vulnerability is present in the standalone SITS:Vision 9.7.0 component of Tribal SITS in its default configuration,
- CVE-2020-9375TP-Link Archer C50 V3 devices before Build 200318 Rel.
- CVE-2020-10788openITCOCKPIT before 3.7.3 uses the 1fea123e07f730f76e661bced33a94152378611e API key rather than generating a random API Key for WebSocket c
- CVE-2020-10789openITCOCKPIT before 3.7.3 has a web-based terminal that allows attackers to execute arbitrary OS commands via shell metacharacters that are
- CVE-2020-10790openITCOCKPIT before 3.7.3 has unnecessary files (such as Lodash files) under the web root, which leads to XSS.
- CVE-2020-10791app/Plugin/GrafanaModule/Controller/GrafanaConfigurationController.php in openITCOCKPIT before 3.7.3 allows remote authenticated users to tr
- CVE-2020-5561Keijiban Tsumiki v1.15 allows remote attackers to execute arbitrary OS commands via unspecified vectors.Mash room - Free CGI - Keijiban Tsumiki
- CVE-2020-5559Cross-site scripting vulnerability in WL-Enq 1.11 and 1.12 allows remote attackers to inject arbitrary web script or HTML via unspecified veWonderLink WL-Enq
- CVE-2020-5560WL-Enq 1.11 and 1.12 allows remote attackers to execute arbitrary OS commands with the administrative privilege via unspecified vectors.WonderLink WL-Enq
- CVE-2020-5556Shihonkanri Plus GOOUT Ver1.5.8 and Ver2.2.10 allows remote attackers to execute arbitrary OS commands via unspecified vectors.EKAKIN Shihonkanri Plus GOOUT
- CVE-2020-5557Cross-site scripting vulnerability in CuteNews 2.0.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.CutePHP.com CuteNews
- CVE-2020-5558CuteNews 2.0.1 allows remote authenticated attackers to execute arbitrary PHP code via unspecified vectors.CutePHP.com CuteNews
- CVE-2020-5554Directory traversal vulnerability in Shihonkanri Plus GOOUT Ver1.5.8 and Ver2.2.10 allows remote attackers to read and write arbitrary filesEKAKIN Shihonkanri Plus GOOUT
- CVE-2020-5555Shihonkanri Plus GOOUT Ver1.5.8 and Ver2.2.10 allows remote attackers to read and write data of the files placed in the same directory whereEKAKIN Shihonkanri Plus GOOUT
- CVE-2020-5552Cross-site scripting vulnerability in mailform version 1.04 allows remote attackers to inject arbitrary web script or HTML via unspecified vkeitai-site.net mailform
- CVE-2020-5553mailform version 1.04 allows remote attackers to execute arbitrary PHP code via unspecified vectors.keitai-site.net mailform