CVEs published March 26, 2020
30 CVEs were published on March 26, 2020: 6 critical, 6 high.
- Published
- 30
- Critical
- 6
- High
- 6
- Medium
- 4
- Low
- 0
- Unrated
- 14
- Now in CISA KEV
- 0
- Fix available
- 7
Most affected products
- Canonical Python-apt · python-apt
- 2
- com.fasterxml.jackson.core:jackson-databind
- 2
- 3S
- 1
- Continuous Delivery for Puppet Enterprise
- 1
- Google Closure-Library · google-closure-library
- 1
- Google Dart SDK
- 1
- HUAWEI P30
- 1
- IBM WebSphere Application Server
- 1
- Mcafee Application and Change Control
- 1
- Micro Focus International Micro Focus - Service Manager Aut…
- 1
Critical 6
- CVE-2020-10828A stack-based buffer overflow in cvmd on Draytek Vigor3900, Vigor2960, and Vigor300B devices before 1.5.1 allows remote attackers to achieve
- CVE-2020-10827A stack-based buffer overflow in apmd on Draytek Vigor3900, Vigor2960, and Vigor300B devices before 1.5.1 allows remote attackers to achieve
- CVE-2020-10826/cgi-bin/activate.cgi on Draytek Vigor3900, Vigor2960, and Vigor300B devices before 1.5.1 allows remote attackers to achieve command injecti
- CVE-2020-10825A stack-based buffer overflow in /cgi-bin/activate.cgi while base64 decoding ticket parameter on Draytek Vigor3900, Vigor2960, and Vigor300B
- CVE-2020-10824A stack-based buffer overflow in /cgi-bin/activate.cgi through ticket parameter on Draytek Vigor3900, Vigor2960, and Vigor300B devices befor
- CVE-2020-10823A stack-based buffer overflow in /cgi-bin/activate.cgi through var parameter on Draytek Vigor3900, Vigor2960, and Vigor300B devices before 1
High 6
- CVE-2019-5105An exploitable memory corruption vulnerability exists in the Name Service Client functionality of 3S-Smart Software Solutions CODESYS Gatewa3S
- CVE-2020-4276IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 traditional is vulnerable to a privilege escalation vulnerability when using token-bIBM WebSphere Application Server
- CVE-2020-10968FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.aoju.bus.com.fasterxml.jackson.core:jackson-databind
- CVE-2020-10969FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to javax.swing.Jcom.fasterxml.jackson.core:jackson-databind
- CVE-2020-1764A hard-coded cryptographic key vulnerability in the default configuration file was found in Kiali, all versions prior to 1.15.1.Red Hat kiali · github.com/kiali/kiali
- CVE-2020-7260MACC installer DLL side loadingMcafee Application and Change Control
Medium, low and unrated 18
- CVE-2020-10990An XXE issue exists in Accenture Mercury before 1.12.28 because of the platformlambda/core/serializers/SimpleXmlParser.java component.
- CVE-2020-10991Mulesoft APIkit through 1.3.0 allows XXE because of validation/RestXmlSchemaValidator.java
- CVE-2020-10992Azkaban through 3.84.0 allows XXE, related to validator/XmlValidatorManager.java and user/XmlUserManager.java.
- CVE-2020-10993Osmand through 2.0.0 allow XXE because of binary/BinaryMapIndexReader.java.
- CVE-2020-9468The Community plugin 2.9.e-beta for Piwigo allows users to set image information on images in albums for which they do not have permission,
- CVE-2020-9467Piwigo 2.10.1 has stored XSS via the file parameter in a /ws.php request because of the pwg.images.setInfo function.
- CVE-2020-9065Huawei smart phone Taurus-AL00B with versions earlier than 10.0.0.203(C00E201R7P2) have a use-after-free (UAF) vulnerability.Taurus-AL00B
- CVE-2020-1800HUAWEI smartphones P30 with versions earlier than 10.0.0.185(C00E85R1P11) have an improper access control vulnerability.HUAWEI P30
- CVE-2020-9066Huawei smartphones OxfordP-AN10B with versions earlier than 10.0.1.169(C00E166R4P1) have an improper authentication vulnerability.OxfordP-AN10B
- CVE-2020-9521An SQL injection vulnerability was discovered in Micro Focus Service Manager Automation (SMA), affecting versions 2019.08, 2019.05, 2019.02,Micro Focus International Micro Focus - Service Manager Aut…
- CVE-2020-7944In Continuous Delivery for Puppet Enterprise (CD4PE) before 3.4.0, changes to resources or classes containing Sensitive parameters can resulContinuous Delivery for Puppet Enterprise
- CVE-2019-15796python-apt downloads from untrusted sourcesCanonical Python-apt · python-apt
- CVE-2019-15795python-apt uses MD5 for validationCanonical Python-apt · python-apt
- CVE-2020-6999In Moxa EDS-G516E Series firmware, Version 5.2 or lower, some of the parameters in the setting pages do not ensure text is the correct size Moxa EDS-G516E Series firmware,
- CVE-2020-8910Auth Bypass in Google's Closure-LibraryGoogle Closure-Library · google-closure-library
- CVE-2020-8923XSS in DartGoogle Dart SDK
- CVE-2020-10245CODESYS V3 web server before 3.5.15.40, as used in CODESYS Control runtime systems, has a buffer overflow.
- CVE-2020-5129A vulnerability in the SonicWall SMA1000 HTTP Extraweb server allows an unauthenticated remote attacker to cause HTTP server crash which leaSonicWall SMA1000