# CVEs published 2020-03-26

30 CVEs were published on March 26, 2020: 6 critical, 6 high. Days are UTC.

- [CVE-2020-10990](https://cve.now/CVE-2020-10990.md): An XXE issue exists in Accenture Mercury before 1.12.28 because of the platformlambda/core/serializers/SimpleXmlParser.java component. (no CVSS)
- [CVE-2020-10991](https://cve.now/CVE-2020-10991.md): Mulesoft APIkit through 1.3.0 allows XXE because of validation/RestXmlSchemaValidator.java (no CVSS)
- [CVE-2020-10992](https://cve.now/CVE-2020-10992.md): Azkaban through 3.84.0 allows XXE, related to validator/XmlValidatorManager.java and user/XmlUserManager.java. (no CVSS)
- [CVE-2020-10993](https://cve.now/CVE-2020-10993.md): Osmand through 2.0.0 allow XXE because of binary/BinaryMapIndexReader.java. (no CVSS)
- [CVE-2020-9468](https://cve.now/CVE-2020-9468.md): The Community plugin 2.9.e-beta for Piwigo allows users to set image information on images in albums for which they do not have permission, (no CVSS)
- [CVE-2020-9467](https://cve.now/CVE-2020-9467.md): Piwigo 2.10.1 has stored XSS via the file parameter in a /ws.php request because of the pwg.images.setInfo function. (no CVSS)
- [CVE-2020-10828](https://cve.now/CVE-2020-10828.md): A stack-based buffer overflow in cvmd on Draytek Vigor3900, Vigor2960, and Vigor300B devices before 1.5.1 allows remote attackers to achieve (CVSS 9.8)
- [CVE-2020-10827](https://cve.now/CVE-2020-10827.md): A stack-based buffer overflow in apmd on Draytek Vigor3900, Vigor2960, and Vigor300B devices before 1.5.1 allows remote attackers to achieve (CVSS 9.8)
- [CVE-2020-10826](https://cve.now/CVE-2020-10826.md): /cgi-bin/activate.cgi on Draytek Vigor3900, Vigor2960, and Vigor300B devices before 1.5.1 allows remote attackers to achieve command injecti (CVSS 9.8)
- [CVE-2020-10825](https://cve.now/CVE-2020-10825.md): A stack-based buffer overflow in /cgi-bin/activate.cgi while base64 decoding ticket parameter on Draytek Vigor3900, Vigor2960, and Vigor300B (CVSS 9.8)
- [CVE-2020-10824](https://cve.now/CVE-2020-10824.md): A stack-based buffer overflow in /cgi-bin/activate.cgi through ticket parameter on Draytek Vigor3900, Vigor2960, and Vigor300B devices befor (CVSS 9.8)
- [CVE-2020-10823](https://cve.now/CVE-2020-10823.md): A stack-based buffer overflow in /cgi-bin/activate.cgi through var parameter on Draytek Vigor3900, Vigor2960, and Vigor300B devices before 1 (CVSS 9.8)
- [CVE-2020-9065](https://cve.now/CVE-2020-9065.md): Huawei smart phone Taurus-AL00B with versions earlier than 10.0.0.203(C00E201R7P2) have a use-after-free (UAF) vulnerability. (no CVSS, Taurus-AL00B)
- [CVE-2020-1800](https://cve.now/CVE-2020-1800.md): HUAWEI smartphones P30 with versions earlier than 10.0.0.185(C00E85R1P11) have an improper access control vulnerability. (no CVSS, HUAWEI P30)
- [CVE-2020-9066](https://cve.now/CVE-2020-9066.md): Huawei smartphones OxfordP-AN10B with versions earlier than 10.0.1.169(C00E166R4P1) have an improper authentication vulnerability. (no CVSS, OxfordP-AN10B)
- [CVE-2020-9521](https://cve.now/CVE-2020-9521.md): An SQL injection vulnerability was discovered in Micro Focus Service Manager Automation (SMA), affecting versions 2019.08, 2019.05, 2019.02, (no CVSS, Micro Focus International Micro Focus - Service Manager Aut…)
- [CVE-2020-7944](https://cve.now/CVE-2020-7944.md): In Continuous Delivery for Puppet Enterprise (CD4PE) before 3.4.0, changes to resources or classes containing Sensitive parameters can resul (no CVSS, Continuous Delivery for Puppet Enterprise)
- [CVE-2019-5105](https://cve.now/CVE-2019-5105.md): An exploitable memory corruption vulnerability exists in the Name Service Client functionality of 3S-Smart Software Solutions CODESYS Gatewa (CVSS 7.5, 3S)
- [CVE-2020-4276](https://cve.now/CVE-2020-4276.md): IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 traditional is vulnerable to a privilege escalation vulnerability when using token-b (CVSS 7.5, IBM WebSphere Application Server)
- [CVE-2019-15796](https://cve.now/CVE-2019-15796.md): python-apt downloads from untrusted sources (CVSS 4.7, Canonical Python-apt · python-apt)
- [CVE-2019-15795](https://cve.now/CVE-2019-15795.md): python-apt uses MD5 for validation (CVSS 4.7, Canonical Python-apt · python-apt)
- [CVE-2020-10968](https://cve.now/CVE-2020-10968.md): FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.aoju.bus. (CVSS 8.8, com.fasterxml.jackson.core:jackson-databind)
- [CVE-2020-10969](https://cve.now/CVE-2020-10969.md): FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to javax.swing.J (CVSS 8.8, com.fasterxml.jackson.core:jackson-databind)
- [CVE-2020-6999](https://cve.now/CVE-2020-6999.md): In Moxa EDS-G516E Series firmware, Version 5.2 or lower, some of the parameters in the setting pages do not ensure text is the correct size (no CVSS, Moxa EDS-G516E Series firmware,)
- [CVE-2020-8910](https://cve.now/CVE-2020-8910.md): Auth Bypass in Google's Closure-Library (CVSS 6.5, Google Closure-Library · google-closure-library)
- [CVE-2020-8923](https://cve.now/CVE-2020-8923.md): XSS in Dart (CVSS 5.4, Google Dart SDK)
- [CVE-2020-1764](https://cve.now/CVE-2020-1764.md): A hard-coded cryptographic key vulnerability in the default configuration file was found in Kiali, all versions prior to 1.15.1. (CVSS 8.6, Red Hat kiali · github.com/kiali/kiali)
- [CVE-2020-7260](https://cve.now/CVE-2020-7260.md): MACC installer DLL side loading (CVSS 7.3, Mcafee Application and Change Control)
- [CVE-2020-10245](https://cve.now/CVE-2020-10245.md): CODESYS V3 web server before 3.5.15.40, as used in CODESYS Control runtime systems, has a buffer overflow. (no CVSS)
- [CVE-2020-5129](https://cve.now/CVE-2020-5129.md): A vulnerability in the SonicWall SMA1000 HTTP Extraweb server allows an unauthenticated remote attacker to cause HTTP server crash which lea (no CVSS, SonicWall SMA1000)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2020-03-26
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.