# CVEs published 2020-03-25 109 CVEs were published on March 25, 2020: 1 critical, 8 high. Days are UTC. - [CVE-2020-10965](https://cve.now/CVE-2020-10965.md): Teradici PCoIP Management Console 20.01.0 and 19.11.1 is vulnerable to unauthenticated password resets via login/resetadminpassword of the d (no CVSS) - [CVE-2020-10966](https://cve.now/CVE-2020-10966.md): In the Password Reset Module in VESTA Control Panel through 0.9.8-25 and Hestia Control Panel before 1.1.1, Host header manipulation leads t (no CVSS) - [CVE-2020-10964](https://cve.now/CVE-2020-10964.md): Serendipity before 2.3.4 on Windows allows remote attackers to execute arbitrary code because the filename of a renamed file may end with a (no CVSS) - [CVE-2020-10963](https://cve.now/CVE-2020-10963.md): FrozenNode Laravel-Administrator through 5.0.12 allows unrestricted file upload (and consequently Remote Code Execution) via admin/tips\_imag (no CVSS, frozennode/administrator) - [CVE-2020-6805](https://cve.now/CVE-2020-6805.md): When removing data about an origin whose tab was recently closed, a use-after-free could occur in the Quota manager, resulting in a potentia (no CVSS, Mozilla Thunderbird · Mozilla Firefox) - [CVE-2020-6806](https://cve.now/CVE-2020-6806.md): By carefully crafting promise resolutions, it was possible to cause an out-of-bounds read off the end of an array resized during script exec (no CVSS, Mozilla Thunderbird · Mozilla Firefox) - [CVE-2020-6807](https://cve.now/CVE-2020-6807.md): When a device was changed while a stream was about to be destroyed, the \stream-reinit\ task may have been executed after the str (no CVSS, Mozilla Thunderbird · Mozilla Firefox) - [CVE-2020-6808](https://cve.now/CVE-2020-6808.md): When a JavaScript URL (javascript:) is evaluated and the result is a string, this string is parsed to create an HTML document, which is then (no CVSS, Mozilla Firefox) - [CVE-2020-6809](https://cve.now/CVE-2020-6809.md): When a Web Extension had the all-urls permission and made a fetch request with a mode set to 'same-origin', it was possible for the Web Exte (no CVSS, Mozilla Firefox) - [CVE-2020-6810](https://cve.now/CVE-2020-6810.md): After a website had entered fullscreen mode, it could have used a previously opened popup to obscure the notification that indicates the bro (no CVSS, Mozilla Firefox) - [CVE-2020-6811](https://cve.now/CVE-2020-6811.md): The 'Copy as cURL' feature of Devtools' network tab did not properly escape the HTTP method of a request, which can be controlled by the web (no CVSS, Mozilla Thunderbird · Mozilla Firefox) - [CVE-2020-6812](https://cve.now/CVE-2020-6812.md): The first time AirPods are connected to an iPhone, they become named after the user's name by default (e.g. (no CVSS, Mozilla Thunderbird · Mozilla Firefox) - [CVE-2020-6813](https://cve.now/CVE-2020-6813.md): When protecting CSS blocks with the nonce feature of Content Security Policy, the @import statement in the CSS block could allow an attacker (no CVSS, Mozilla Firefox) - [CVE-2020-6814](https://cve.now/CVE-2020-6814.md): Mozilla developers reported memory safety bugs present in Firefox and Thunderbird 68.5. (no CVSS, Mozilla Thunderbird · Mozilla Firefox) - [CVE-2020-6815](https://cve.now/CVE-2020-6815.md): Mozilla developers reported memory safety and script safety bugs present in Firefox 73. (no CVSS, Mozilla Firefox) - [CVE-2020-5340](https://cve.now/CVE-2020-5340.md): RSA Authentication Manager versions prior to 8.4 P10 contain a stored cross-site scripting vulnerability in the Security Console. (CVSS 4.8, Dell RSA Authentication Manager) - [CVE-2020-5339](https://cve.now/CVE-2020-5339.md): RSA Authentication Manager versions prior to 8.4 P10 contain a stored cross-site scripting vulnerability in the Security Console. (CVSS 4.8, Dell RSA Authentication Manager) - [CVE-2020-9520](https://cve.now/CVE-2020-9520.md): A stored XSS vulnerability was discovered in Micro Focus Vibe, affecting all Vibe version prior to 4.0.7. (no CVSS, Micro Focus International Micro Focus Vibe.) - [CVE-2020-3776](https://cve.now/CVE-2020-3776.md): Adobe Photoshop CC 2019 versions 20.0.8 and earlier, and Photoshop 2020 versions 21.1 and earlier have a buffer errors vulnerability. (no CVSS, Adobe Photoshop) - [CVE-2020-3777](https://cve.now/CVE-2020-3777.md): Adobe Photoshop CC 2019 versions 20.0.8 and earlier, and Photoshop 2020 versions 21.1 and earlier have an out-of-bounds read vulnerability. (no CVSS, Adobe Photoshop) - [CVE-2020-3778](https://cve.now/CVE-2020-3778.md): Adobe Photoshop versions Photoshop CC 2019, and Photoshop 2020 have an out-of-bounds read vulnerability. (no CVSS, Adobe Photoshop) - [CVE-2020-3788](https://cve.now/CVE-2020-3788.md): Adobe Photoshop CC 2019 versions 20.0.8 and earlier, and Photoshop 2020 versions 21.1 and earlier have a memory corruption vulnerability. (no CVSS, Adobe Photoshop) - [CVE-2020-3771](https://cve.now/CVE-2020-3771.md): Adobe Photoshop CC 2019 versions 20.0.8 and earlier, and Photoshop 2020 versions 21.1 and earlier have an out-of-bounds read vulnerability. (no CVSS, Adobe Photoshop) - [CVE-2020-3779](https://cve.now/CVE-2020-3779.md): Adobe Photoshop CC 2019 versions 20.0.8 and earlier, and Photoshop 2020 versions 21.1 and earlier have an out-of-bounds write vulnerability. (no CVSS, Adobe Photoshop) - [CVE-2020-3790](https://cve.now/CVE-2020-3790.md): Adobe Photoshop CC 2019 versions 20.0.8 and earlier, and Photoshop 2020 versions 21.1 and earlier have a memory corruption vulnerability. (no CVSS, Adobe Photoshop) - [CVE-2020-3775](https://cve.now/CVE-2020-3775.md): Adobe Photoshop CC 2019 versions 20.0.8 and earlier, and Photoshop 2020 versions 21.1 and earlier have a buffer errors vulnerability. (no CVSS, Adobe Photoshop) - [CVE-2020-3791](https://cve.now/CVE-2020-3791.md): Adobe Photoshop CC 2019 versions 20.0.8 and earlier, and Photoshop 2020 versions 21.1 and earlier have an out-of-bounds read vulnerability. (no CVSS, Adobe Photoshop) - [CVE-2020-3774](https://cve.now/CVE-2020-3774.md): Adobe Photoshop CC 2019 versions 20.0.8 and earlier, and Photoshop 2020 versions 21.1 and earlier have a buffer errors vulnerability. (no CVSS, Adobe Photoshop) - [CVE-2020-3789](https://cve.now/CVE-2020-3789.md): Adobe Photoshop CC 2019 versions 20.0.8 and earlier, and Photoshop 2020 versions 21.1 and earlier have a memory corruption vulnerability. (no CVSS, Adobe Photoshop) - [CVE-2020-3773](https://cve.now/CVE-2020-3773.md): Adobe Photoshop CC 2019 versions 20.0.8 and earlier, and Photoshop 2020 versions 21.1 and earlier have an out-of-bounds write vulnerability. (no CVSS, Adobe Photoshop) - [CVE-2020-3781](https://cve.now/CVE-2020-3781.md): Adobe Photoshop CC 2019 versions 20.0.8 and earlier, and Photoshop 2020 versions 21.1 and earlier have an out-of-bounds read vulnerability. (no CVSS, Adobe Photoshop) - [CVE-2020-3772](https://cve.now/CVE-2020-3772.md): Adobe Photoshop CC 2019 versions 20.0.8 and earlier, and Photoshop 2020 versions 21.1 and earlier have a buffer errors vulnerability. (no CVSS, Adobe Photoshop) - [CVE-2020-3785](https://cve.now/CVE-2020-3785.md): Adobe Photoshop CC 2019 versions 20.0.8 and earlier, and Photoshop 2020 versions 21.1 and earlier have a memory corruption vulnerability. (no CVSS, Adobe Photoshop) - [CVE-2020-3784](https://cve.now/CVE-2020-3784.md): Adobe Photoshop CC 2019 versions 20.0.8 and earlier, and Photoshop 2020 versions 21.1 and earlier have a memory corruption vulnerability. (no CVSS, Adobe Photoshop) - [CVE-2020-3780](https://cve.now/CVE-2020-3780.md): Adobe Photoshop CC 2019 versions 20.0.8 and earlier, and Photoshop 2020 versions 21.1 and earlier have a buffer errors vulnerability. (no CVSS, Adobe Photoshop) - [CVE-2020-3783](https://cve.now/CVE-2020-3783.md): Adobe Photoshop CC 2019 versions 20.0.8 and earlier, and Photoshop 2020 versions 21.1 and earlier have a heap corruption vulnerability. (no CVSS, Adobe Photoshop) - [CVE-2020-3787](https://cve.now/CVE-2020-3787.md): Adobe Photoshop CC 2019 versions 20.0.8 and earlier, and Photoshop 2020 versions 21.1 and earlier have a memory corruption vulnerability. (no CVSS, Adobe Photoshop) - [CVE-2020-3782](https://cve.now/CVE-2020-3782.md): Adobe Photoshop CC 2019 versions 20.0.8 and earlier, and Photoshop 2020 versions 21.1 and earlier have an out-of-bounds read vulnerability. (no CVSS, Adobe Photoshop) - [CVE-2020-3770](https://cve.now/CVE-2020-3770.md): Adobe Photoshop CC 2019 versions 20.0.8 and earlier, and Photoshop 2020 versions 21.1 and earlier have a buffer errors vulnerability. (no CVSS, Adobe Photoshop) - [CVE-2020-3786](https://cve.now/CVE-2020-3786.md): Adobe Photoshop CC 2019 versions 20.0.8 and earlier, and Photoshop 2020 versions 21.1 and earlier have a memory corruption vulnerability. (no CVSS, Adobe Photoshop) - [CVE-2020-10887](https://cve.now/CVE-2020-10887.md): This vulnerability allows a firewall bypass on affected installations of TP-Link Archer A7 Firmware Ver: 190726 AC1750 routers. (CVSS 8.1, TP-Link Archer A7) - [CVE-2020-10888](https://cve.now/CVE-2020-10888.md): This vulnerability allows remote attackers to bypass authentication on affected installations of TP-Link Archer A7 Firmware Ver: 190726 AC17 (CVSS 5.9, TP-Link Archer A7) - [CVE-2020-10885](https://cve.now/CVE-2020-10885.md): This vulnerability allows remote attackers to execute arbitrary code on affected installations of TP-Link Archer A7 Firmware Ver: 190726 AC1 (CVSS 8.1, TP-Link Archer A7) - [CVE-2020-10886](https://cve.now/CVE-2020-10886.md): This vulnerability allows remote attackers to execute arbitrary code on affected installations of TP-Link Archer A7 Firmware Ver: 190726 AC1 (CVSS 8.1, TP-Link Archer A7) - [CVE-2020-10883](https://cve.now/CVE-2020-10883.md): This vulnerability allows local attackers to escalate privileges on affected installations of TP-Link Archer A7 Firmware Ver: 190726 AC1750 (CVSS 5.3, TP-Link Archer A7) - [CVE-2020-10884](https://cve.now/CVE-2020-10884.md): This vulnerability allows network-adjacent attackers execute arbitrary code on affected installations of TP-Link Archer A7 Firmware Ver: 190 (CVSS 8.1, TP-Link Archer A7) - [CVE-2020-10881](https://cve.now/CVE-2020-10881.md): This vulnerability allows remote attackers to execute arbitrary code on affected installations of TP-Link Archer A7 Firmware Ver: 190726 AC1 (CVSS 9.8, TP-Link Archer A7) - [CVE-2020-10882](https://cve.now/CVE-2020-10882.md): This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of TP-Link Archer A7 Firmware Ver: (CVSS 8.8, TP-Link Archer A7) - [CVE-2020-3808](https://cve.now/CVE-2020-3808.md): Creative Cloud Desktop Application versions 5.0 and earlier have a time-of-check to time-of-use (toctou) race condition vulnerability. (no CVSS, Adobe Creative Cloud Desktop Application) - [CVE-2020-3794](https://cve.now/CVE-2020-3794.md): ColdFusion versions ColdFusion 2016, and ColdFusion 2018 have a file inclusion vulnerability. (no CVSS, Adobe ColdFusion) - [CVE-2020-3761](https://cve.now/CVE-2020-3761.md): ColdFusion versions ColdFusion 2016, and ColdFusion 2018 have a remote file read vulnerability. (no CVSS, Adobe ColdFusion) - [CVE-2020-9552](https://cve.now/CVE-2020-9552.md): Adobe Bridge versions 10.0 have a heap-based buffer overflow vulnerability. (no CVSS, Adobe Bridge) - [CVE-2020-9551](https://cve.now/CVE-2020-9551.md): Adobe Bridge versions 10.0 have an out-of-bounds write vulnerability. (no CVSS, Adobe Bridge) - [CVE-2020-3769](https://cve.now/CVE-2020-3769.md): Adobe Experience Manager versions 6.5 and earlier have a server-side request forgery (ssrf) vulnerability. (no CVSS, Adobe Experience Manager) - [CVE-2020-5277](https://cve.now/CVE-2020-5277.md): Reflected XSS with url\_name parameter of PrestaShop module ps\_facetedsearch (CVSS 4.1, PrestaShop ps\_facetedsearch) - [CVE-2020-5282](https://cve.now/CVE-2020-5282.md): arbitrary shell execution in Nick Chan Bot (CVSS 7.2, Nick Chan nickchanbot) - [CVE-2020-5281](https://cve.now/CVE-2020-5281.md): LDAP connector injection in Perun (CVSS 6.2, CESNET perun) - [CVE-2020-5280](https://cve.now/CVE-2020-5280.md): Local file inclusion vulnerability in http4s (CVSS 7.6, http4s · org.http4s:http4s-server\_2.12) - [CVE-2020-3766](https://cve.now/CVE-2020-3766.md): Adobe Genuine Integrity Service versions Version 6.4 and earlier have an insecure file permissions vulnerability. (no CVSS, Adobe Genuine Integrity Service) - [CVE-2020-3803](https://cve.now/CVE-2020-3803.md): Adobe Acrobat and Reader versions 2020.006.20034 and earlier, 2017.011.30158 and earlier, 2017.011.30158 and earlier, 2015.006.30510 and ear (no CVSS, Adobe Acrobat and Reader) - [CVE-2020-3807](https://cve.now/CVE-2020-3807.md): Adobe Acrobat and Reader versions 2020.006.20034 and earlier, 2017.011.30158 and earlier, 2017.011.30158 and earlier, 2015.006.30510 and ear (no CVSS, Adobe Acrobat and Reader) - [CVE-2020-3804](https://cve.now/CVE-2020-3804.md): Adobe Acrobat and Reader versions 2020.006.20034 and earlier, 2017.011.30158 and earlier, 2017.011.30158 and earlier, 2015.006.30510 and ear (no CVSS, Adobe Acrobat and Reader) - [CVE-2020-3806](https://cve.now/CVE-2020-3806.md): Adobe Acrobat and Reader versions 2020.006.20034 and earlier, 2017.011.30158 and earlier, 2017.011.30158 and earlier, 2015.006.30510 and ear (no CVSS, Adobe Acrobat and Reader) - [CVE-2020-3802](https://cve.now/CVE-2020-3802.md): Adobe Acrobat and Reader versions 2020.006.20034 and earlier, 2017.011.30158 and earlier, 2017.011.30158 and earlier, 2015.006.30510 and ear (no CVSS, Adobe Acrobat and Reader) - [CVE-2020-3805](https://cve.now/CVE-2020-3805.md): Adobe Acrobat and Reader versions 2020.006.20034 and earlier, 2017.011.30158 and earlier, 2017.011.30158 and earlier, 2015.006.30510 and ear (no CVSS, Adobe Acrobat and Reader) - [CVE-2020-3801](https://cve.now/CVE-2020-3801.md): Adobe Acrobat and Reader versions 2020.006.20034 and earlier, 2017.011.30158 and earlier, 2017.011.30158 and earlier, 2015.006.30510 and ear (no CVSS, Adobe Acrobat and Reader) - [CVE-2020-3800](https://cve.now/CVE-2020-3800.md): Adobe Acrobat and Reader versions 2020.006.20034 and earlier, 2017.011.30158 and earlier, 2017.011.30158 and earlier, 2015.006.30510 and ear (no CVSS, Adobe Acrobat and Reader) - [CVE-2019-18626](https://cve.now/CVE-2019-18626.md): Harris Ormed Self Service before 2019.1.4 allows an authenticated user to view W-2 forms belonging to other users via an arbitrary empNo val (no CVSS) - [CVE-2019-7630](https://cve.now/CVE-2019-7630.md): An issue was discovered in gdrv.sys in Gigabyte APP Center before 19.0227.1. (no CVSS) - [CVE-2019-7244](https://cve.now/CVE-2019-7244.md): An issue was discovered in kerneld.sys in AIDA64 before 5.99. (no CVSS) - [CVE-2019-7240](https://cve.now/CVE-2019-7240.md): An issue was discovered in WinRing0x64.sys in Moo0 System Monitor 1.83. (no CVSS) - [CVE-2019-20633](https://cve.now/CVE-2019-20633.md): GNU patch through 2.7.6 contains a free(p\_line\[p\_end\]) Double Free vulnerability in the function another\_hunk in pch.c that can cause a deni (no CVSS) - [CVE-2019-7245](https://cve.now/CVE-2019-7245.md): An issue was discovered in GPU-Z.sys in TechPowerUp GPU-Z before 2.23.0. (no CVSS) - [CVE-2020-10649](https://cve.now/CVE-2020-10649.md): DevActSvc.exe in ASUS Device Activation before 1.0.7.0 for Windows 10 notebooks and PCs could lead to unsigned code execution with no additi (no CVSS) - [CVE-2020-2171](https://cve.now/CVE-2020-2171.md): Jenkins RapidDeploy Plugin 4.2 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. (no CVSS, Jenkins project Jenkins RapidDeploy Plugin · org.jenkins-ci…) - [CVE-2020-2169](https://cve.now/CVE-2020-2169.md): A form validation endpoint in Jenkins Queue cleanup Plugin 1.3 and earlier does not properly escape a query parameter displayed in an error (no CVSS, Jenkins project Jenkins Queue cleanup Plugin · org.jenkins-…) - [CVE-2020-2170](https://cve.now/CVE-2020-2170.md): Jenkins RapidDeploy Plugin 4.2 and earlier does not escape package names in the table of packages obtained from a remote server, resulting i (no CVSS, Jenkins project Jenkins RapidDeploy Plugin · org.jenkins-ci…) - [CVE-2020-2166](https://cve.now/CVE-2020-2166.md): Jenkins Pipeline: AWS Steps Plugin 1.40 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types, resu (no CVSS, Jenkins project Jenkins Pipeline: AWS Steps Plugin · de.tai…) - [CVE-2020-2167](https://cve.now/CVE-2020-2167.md): Jenkins OpenShift Pipeline Plugin 1.0.56 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types, res (no CVSS, Jenkins project Jenkins OpenShift Pipeline Plugin · com.ope…) - [CVE-2020-2168](https://cve.now/CVE-2020-2168.md): Jenkins Azure Container Service Plugin 1.0.1 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types, (no CVSS, Jenkins project Jenkins Azure Container Service Plugin · or…) - [CVE-2020-2164](https://cve.now/CVE-2020-2164.md): Jenkins Artifactory Plugin 3.5.0 and earlier stores its Artifactory server password unencrypted in its global configuration file on the Jenk (no CVSS, Jenkins project Jenkins Artifactory Plugin · org.jenkins-ci…) - [CVE-2020-2165](https://cve.now/CVE-2020-2165.md): Jenkins Artifactory Plugin 3.6.0 and earlier transmits configured passwords in plain text as part of its global Jenkins configuration form, (no CVSS, Jenkins project Jenkins Artifactory Plugin · org.jenkins-ci…) - [CVE-2020-2162](https://cve.now/CVE-2020-2162.md): Jenkins 2.227 and earlier, LTS 2.204.5 and earlier does not set Content-Security-Policy headers for files uploaded as file parameters to a b (no CVSS, Jenkins project Jenkins · org.jenkins-ci.main:jenkins-core) - [CVE-2020-2163](https://cve.now/CVE-2020-2163.md): Jenkins 2.227 and earlier, LTS 2.204.5 and earlier improperly processes HTML content of list view column headers, resulting in a stored XSS (no CVSS, Jenkins project Jenkins · org.jenkins-ci.main:jenkins-core) - [CVE-2020-2160](https://cve.now/CVE-2020-2160.md): Jenkins 2.227 and earlier, LTS 2.204.5 and earlier uses different representations of request URL paths, which allows attackers to craft URLs (no CVSS, Jenkins project Jenkins · org.jenkins-ci.main:jenkins-core) - [CVE-2020-2161](https://cve.now/CVE-2020-2161.md): Jenkins 2.227 and earlier, LTS 2.204.5 and earlier does not properly escape node labels that are shown in the form validation for label expr (no CVSS, Jenkins project Jenkins · org.jenkins-ci.main:jenkins-core) - [CVE-2020-3797](https://cve.now/CVE-2020-3797.md): Adobe Acrobat and Reader versions 2020.006.20034 and earlier, 2017.011.30158 and earlier, 2017.011.30158 and earlier, 2015.006.30510 and ear (no CVSS, Adobe Acrobat and Reader) - [CVE-2020-3799](https://cve.now/CVE-2020-3799.md): Adobe Acrobat and Reader versions 2020.006.20034 and earlier, 2017.011.30158 and earlier, 2017.011.30158 and earlier, 2015.006.30510 and ear (no CVSS, Adobe Acrobat and Reader) - [CVE-2020-3795](https://cve.now/CVE-2020-3795.md): Adobe Acrobat and Reader versions 2020.006.20034 and earlier, 2017.011.30158 and earlier, 2017.011.30158 and earlier, 2015.006.30510 and ear (no CVSS, Adobe Acrobat and Reader) - [CVE-2020-3793](https://cve.now/CVE-2020-3793.md): Adobe Acrobat and Reader versions 2020.006.20034 and earlier, 2017.011.30158 and earlier, 2017.011.30158 and earlier, 2015.006.30510 and ear (no CVSS, Adobe Acrobat and Reader) - [CVE-2020-3792](https://cve.now/CVE-2020-3792.md): Adobe Acrobat and Reader versions 2020.006.20034 and earlier, 2017.011.30158 and earlier, 2017.011.30158 and earlier, 2015.006.30510 and ear (no CVSS, Adobe Acrobat and Reader) - [CVE-2020-1957](https://cve.now/CVE-2020-1957.md): Apache Shiro before 1.5.2, when using Apache Shiro with Spring dynamic controllers, a specially crafted request may cause an authentication (no CVSS, Apache Shiro · org.apache.shiro:shiro-core) - [CVE-2019-19127](https://cve.now/CVE-2019-19127.md): An authentication bypass vulnerability is present in the standalone SITS:Vision 9.7.0 component of Tribal SITS in its default configuration, (no CVSS) - [CVE-2020-9375](https://cve.now/CVE-2020-9375.md): TP-Link Archer C50 V3 devices before Build 200318 Rel. (no CVSS) - [CVE-2020-10788](https://cve.now/CVE-2020-10788.md): openITCOCKPIT before 3.7.3 uses the 1fea123e07f730f76e661bced33a94152378611e API key rather than generating a random API Key for WebSocket c (no CVSS) - [CVE-2020-10789](https://cve.now/CVE-2020-10789.md): openITCOCKPIT before 3.7.3 has a web-based terminal that allows attackers to execute arbitrary OS commands via shell metacharacters that are (no CVSS) - [CVE-2020-10790](https://cve.now/CVE-2020-10790.md): openITCOCKPIT before 3.7.3 has unnecessary files (such as Lodash files) under the web root, which leads to XSS. (no CVSS) - [CVE-2020-10791](https://cve.now/CVE-2020-10791.md): app/Plugin/GrafanaModule/Controller/GrafanaConfigurationController.php in openITCOCKPIT before 3.7.3 allows remote authenticated users to tr (no CVSS) - [CVE-2020-5561](https://cve.now/CVE-2020-5561.md): Keijiban Tsumiki v1.15 allows remote attackers to execute arbitrary OS commands via unspecified vectors. (no CVSS, Mash room - Free CGI - Keijiban Tsumiki) - [CVE-2020-5559](https://cve.now/CVE-2020-5559.md): Cross-site scripting vulnerability in WL-Enq 1.11 and 1.12 allows remote attackers to inject arbitrary web script or HTML via unspecified ve (no CVSS, WonderLink WL-Enq) - [CVE-2020-5560](https://cve.now/CVE-2020-5560.md): WL-Enq 1.11 and 1.12 allows remote attackers to execute arbitrary OS commands with the administrative privilege via unspecified vectors. (no CVSS, WonderLink WL-Enq) - [CVE-2020-5556](https://cve.now/CVE-2020-5556.md): Shihonkanri Plus GOOUT Ver1.5.8 and Ver2.2.10 allows remote attackers to execute arbitrary OS commands via unspecified vectors. (no CVSS, EKAKIN Shihonkanri Plus GOOUT) - [CVE-2020-5557](https://cve.now/CVE-2020-5557.md): Cross-site scripting vulnerability in CuteNews 2.0.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. (no CVSS, CutePHP.com CuteNews) - [CVE-2020-5558](https://cve.now/CVE-2020-5558.md): CuteNews 2.0.1 allows remote authenticated attackers to execute arbitrary PHP code via unspecified vectors. (no CVSS, CutePHP.com CuteNews) - [CVE-2020-5554](https://cve.now/CVE-2020-5554.md): Directory traversal vulnerability in Shihonkanri Plus GOOUT Ver1.5.8 and Ver2.2.10 allows remote attackers to read and write arbitrary files (no CVSS, EKAKIN Shihonkanri Plus GOOUT) - [CVE-2020-5555](https://cve.now/CVE-2020-5555.md): Shihonkanri Plus GOOUT Ver1.5.8 and Ver2.2.10 allows remote attackers to read and write data of the files placed in the same directory where (no CVSS, EKAKIN Shihonkanri Plus GOOUT) - [CVE-2020-5552](https://cve.now/CVE-2020-5552.md): Cross-site scripting vulnerability in mailform version 1.04 allows remote attackers to inject arbitrary web script or HTML via unspecified v (no CVSS, keitai-site.net mailform) - [CVE-2020-5553](https://cve.now/CVE-2020-5553.md): mailform version 1.04 allows remote attackers to execute arbitrary PHP code via unspecified vectors. (no CVSS, keitai-site.net mailform) - [CVE-2020-5261](https://cve.now/CVE-2020-5261.md): Missing Token Replay Detection (CVSS 8.2, Sustainsys Saml2 · Sustainsys.Saml2) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2020-03-25 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.