CVEs published March 27, 2020
39 CVEs were published on March 27, 2020: 1 critical, 6 high.
- Published
- 39
- Critical
- 1
- High
- 6
- Medium
- 5
- Low
- 2
- Unrated
- 25
- Now in CISA KEV
- 0
- Fix available
- 2
Most affected products
- OTRS AG ((OTRS)) Community Edition · OTRS AG OTRS
- 5
- BIG-IP
- 4
- Sunnet eHRD
- 3
- Unisoon UltraLog Express
- 3
- BIG-IP, BIG-IQ
- 2
- Advantech WebAccess
- 1
- GStreamer
- 1
- Kubernetes · k8s.io/apiserver
- 1
- Kubernetes · k8s.io/kubernetes
- 1
- NGINX Controller
- 1
Critical 1
High 6
- CVE-2020-6095An exploitable denial of service vulnerability exists in the GstRTSPAuth functionality of GStreamer/gst-rtsp-server 1.14.5.GStreamer
- CVE-2020-1773Session / Password / Password token leakOTRS AG ((OTRS)) Community Edition · OTRS AG OTRS
- CVE-2020-10510Sunnet eHRD - Broken Access ControlSunnet eHRD
- CVE-2020-10508Sunnet eHRD - Sensitive Data ExposureSunnet eHRD
- CVE-2020-3921Unisoon UltraLog Express - Sensitive Data ExposureUnisoon UltraLog Express
- CVE-2020-3920Unisoon UltraLog Express - Broken AuthenticationUnisoon UltraLog Express
Medium, low and unrated 32
- CVE-2020-10940Local Privilege Escalation can occur in PHOENIX CONTACT PORTICO SERVER through 3.0.7 when installed to run as a service.
- CVE-2020-10939Insecure, default path permissions in PHOENIX CONTACT PC WORX SRT through 1.14 allow for local privilege escalation.
- CVE-2020-10952GitLab EE/CE 8.11 through 12.9.1 allows blocked users to pull/push docker images.
- CVE-2020-10953In GitLab EE 11.7 through 12.9, the NPM feature is vulnerable to a path traversal issue.
- CVE-2020-10954GitLab through 12.9 is affected by a potential DoS in repository archive download.
- CVE-2020-10955GitLab EE/CE 11.1 through 12.9 is vulnerable to parameter tampering on an upload feature that allows an unauthorized user to read content av
- CVE-2020-10956GitLab 8.10 and later through 12.9 is vulnerable to an SSRF in a project import note feature.
- CVE-2020-10817The custom-searchable-data-entry-system (aka Custom Searchable Data Entry System) plugin through 1.7.1 for WordPress allows SQL Injection.
- CVE-2020-5862On BIG-IP 15.1.0-15.1.0.1, 15.0.0-15.0.1.1, and 14.1.0-14.1.2.2, under certain conditions, TMM may crash or stop processing new traffic withBIG-IP
- CVE-2020-5863In NGINX Controller versions prior to 3.2.0, an unauthenticated attacker with network access to the Controller API can create unprivileged uNGINX Controller
- CVE-2020-5861On BIG-IP 12.1.0-12.1.5, the TMM process may produce a core file in some cases when Ram Cache incorrectly optimizes stored data resulting inBIG-IP
- CVE-2020-5858On BIG-IP 15.0.0-15.0.1.2, 14.1.0-14.1.2.2, 13.1.0-13.1.3.2, 12.1.0-12.1.5, and 11.5.2-11.6.5.1 and BIG-IQ 7.0.0, 6.0.0-6.1.0, and 5.2.0-5.4BIG-IP, BIG-IQ
- CVE-2020-5859On BIG-IP 15.1.0.1, specially formatted HTTP/3 messages may cause TMM to produce a core file.BIG-IP
- CVE-2020-5860On BIG-IP 15.0.0-15.1.0.2, 14.1.0-14.1.2.3, 13.1.0-13.1.3.2, 12.1.0-12.1.5.1, and 11.5.2-11.6.5.1 and BIG-IQ 7.0.0, 6.0.0-6.1.0, and 5.2.0-5BIG-IP, BIG-IQ
- CVE-2020-8552Kubernetes API server denial of serviceKubernetes · k8s.io/apiserver
- CVE-2020-8551Kubernetes kubelet denial of serviceKubernetes · k8s.io/kubernetes
- CVE-2020-5857On BIG-IP 15.0.0-15.0.1, 14.1.0-14.1.2.2, 13.1.0-13.1.3.1, 12.1.0-12.1.5, and 11.5.2-11.6.5.1, undisclosed HTTP behavior may lead to a deniaBIG-IP
- CVE-2015-5684MITRE is populating this ID because it was assigned prior to Lenovo becoming a CNA.
- CVE-2015-7333MITRE is populating this ID because it was assigned prior to Lenovo becoming a CNA.
- CVE-2015-7334MITRE is populating this ID because it was assigned prior to Lenovo becoming a CNA.
- CVE-2015-7335MITRE is populating this ID because it was assigned prior to Lenovo becoming a CNA.
- CVE-2015-7336MITRE is populating this ID because it was assigned prior to Lenovo becoming a CNA.
- CVE-2015-8534MITRE is populating this ID because it was assigned prior to Lenovo becoming a CNA.
- CVE-2015-8535MITRE is populating this ID because it was assigned prior to Lenovo becoming a CNA.
- CVE-2015-8536MITRE is populating this ID because it was assigned prior to Lenovo becoming a CNA.
- CVE-2020-7918An insecure direct object reference in webmail in totemo totemomail 7.0.0 allows an authenticated remote user to read and modify mail folder
- CVE-2020-10607In Advantech WebAccess, Versions 8.4.2 and prior.Advantech WebAccess
- CVE-2020-1772Information DisclosureOTRS AG ((OTRS)) Community Edition · OTRS AG OTRS
- CVE-2020-1771Possible XSS in Customer user address bookOTRS AG ((OTRS)) Community Edition · OTRS AG OTRS
- CVE-2020-1770Information disclosure in support bundle filesOTRS AG ((OTRS)) Community Edition · OTRS AG OTRS
- CVE-2020-1769Autocomplete in the form login screensOTRS AG ((OTRS)) Community Edition · OTRS AG OTRS
- CVE-2020-10509Sunnet eHRD - Cross-Site ScriptingSunnet eHRD