# CVEs published 2020-03-27 39 CVEs were published on March 27, 2020: 1 critical, 6 high. Days are UTC. - [CVE-2020-10940](https://cve.now/CVE-2020-10940.md): Local Privilege Escalation can occur in PHOENIX CONTACT PORTICO SERVER through 3.0.7 when installed to run as a service. (no CVSS) - [CVE-2020-10939](https://cve.now/CVE-2020-10939.md): Insecure, default path permissions in PHOENIX CONTACT PC WORX SRT through 1.14 allow for local privilege escalation. (no CVSS) - [CVE-2020-6095](https://cve.now/CVE-2020-6095.md): An exploitable denial of service vulnerability exists in the GstRTSPAuth functionality of GStreamer/gst-rtsp-server 1.14.5. (CVSS 7.5, GStreamer) - [CVE-2020-10952](https://cve.now/CVE-2020-10952.md): GitLab EE/CE 8.11 through 12.9.1 allows blocked users to pull/push docker images. (no CVSS) - [CVE-2020-10953](https://cve.now/CVE-2020-10953.md): In GitLab EE 11.7 through 12.9, the NPM feature is vulnerable to a path traversal issue. (no CVSS) - [CVE-2020-10954](https://cve.now/CVE-2020-10954.md): GitLab through 12.9 is affected by a potential DoS in repository archive download. (no CVSS) - [CVE-2020-10955](https://cve.now/CVE-2020-10955.md): GitLab EE/CE 11.1 through 12.9 is vulnerable to parameter tampering on an upload feature that allows an unauthorized user to read content av (no CVSS) - [CVE-2020-10956](https://cve.now/CVE-2020-10956.md): GitLab 8.10 and later through 12.9 is vulnerable to an SSRF in a project import note feature. (no CVSS) - [CVE-2020-10817](https://cve.now/CVE-2020-10817.md): The custom-searchable-data-entry-system (aka Custom Searchable Data Entry System) plugin through 1.7.1 for WordPress allows SQL Injection. (no CVSS) - [CVE-2020-5862](https://cve.now/CVE-2020-5862.md): On BIG-IP 15.1.0-15.1.0.1, 15.0.0-15.0.1.1, and 14.1.0-14.1.2.2, under certain conditions, TMM may crash or stop processing new traffic with (no CVSS, BIG-IP) - [CVE-2020-5863](https://cve.now/CVE-2020-5863.md): In NGINX Controller versions prior to 3.2.0, an unauthenticated attacker with network access to the Controller API can create unprivileged u (no CVSS, NGINX Controller) - [CVE-2020-5861](https://cve.now/CVE-2020-5861.md): On BIG-IP 12.1.0-12.1.5, the TMM process may produce a core file in some cases when Ram Cache incorrectly optimizes stored data resulting in (no CVSS, BIG-IP) - [CVE-2020-5858](https://cve.now/CVE-2020-5858.md): On BIG-IP 15.0.0-15.0.1.2, 14.1.0-14.1.2.2, 13.1.0-13.1.3.2, 12.1.0-12.1.5, and 11.5.2-11.6.5.1 and BIG-IQ 7.0.0, 6.0.0-6.1.0, and 5.2.0-5.4 (no CVSS, BIG-IP, BIG-IQ) - [CVE-2020-5859](https://cve.now/CVE-2020-5859.md): On BIG-IP 15.1.0.1, specially formatted HTTP/3 messages may cause TMM to produce a core file. (no CVSS, BIG-IP) - [CVE-2020-5860](https://cve.now/CVE-2020-5860.md): On BIG-IP 15.0.0-15.1.0.2, 14.1.0-14.1.2.3, 13.1.0-13.1.3.2, 12.1.0-12.1.5.1, and 11.5.2-11.6.5.1 and BIG-IQ 7.0.0, 6.0.0-6.1.0, and 5.2.0-5 (no CVSS, BIG-IP, BIG-IQ) - [CVE-2020-8552](https://cve.now/CVE-2020-8552.md): Kubernetes API server denial of service (CVSS 5.3, Kubernetes · k8s.io/apiserver) - [CVE-2020-8551](https://cve.now/CVE-2020-8551.md): Kubernetes kubelet denial of service (CVSS 4.3, Kubernetes · k8s.io/kubernetes) - [CVE-2020-5857](https://cve.now/CVE-2020-5857.md): On BIG-IP 15.0.0-15.0.1, 14.1.0-14.1.2.2, 13.1.0-13.1.3.1, 12.1.0-12.1.5, and 11.5.2-11.6.5.1, undisclosed HTTP behavior may lead to a denia (no CVSS, BIG-IP) - [CVE-2015-5684](https://cve.now/CVE-2015-5684.md): MITRE is populating this ID because it was assigned prior to Lenovo becoming a CNA. (no CVSS) - [CVE-2015-7333](https://cve.now/CVE-2015-7333.md): MITRE is populating this ID because it was assigned prior to Lenovo becoming a CNA. (no CVSS) - [CVE-2015-7334](https://cve.now/CVE-2015-7334.md): MITRE is populating this ID because it was assigned prior to Lenovo becoming a CNA. (no CVSS) - [CVE-2015-7335](https://cve.now/CVE-2015-7335.md): MITRE is populating this ID because it was assigned prior to Lenovo becoming a CNA. (no CVSS) - [CVE-2015-7336](https://cve.now/CVE-2015-7336.md): MITRE is populating this ID because it was assigned prior to Lenovo becoming a CNA. (no CVSS) - [CVE-2015-8534](https://cve.now/CVE-2015-8534.md): MITRE is populating this ID because it was assigned prior to Lenovo becoming a CNA. (no CVSS) - [CVE-2015-8535](https://cve.now/CVE-2015-8535.md): MITRE is populating this ID because it was assigned prior to Lenovo becoming a CNA. (no CVSS) - [CVE-2015-8536](https://cve.now/CVE-2015-8536.md): MITRE is populating this ID because it was assigned prior to Lenovo becoming a CNA. (no CVSS) - [CVE-2020-7918](https://cve.now/CVE-2020-7918.md): An insecure direct object reference in webmail in totemo totemomail 7.0.0 allows an authenticated remote user to read and modify mail folder (no CVSS) - [CVE-2020-10607](https://cve.now/CVE-2020-10607.md): In Advantech WebAccess, Versions 8.4.2 and prior. (no CVSS, Advantech WebAccess) - [CVE-2020-1773](https://cve.now/CVE-2020-1773.md): Session / Password / Password token leak (CVSS 7.3, OTRS AG ((OTRS)) Community Edition · OTRS AG OTRS) - [CVE-2020-1772](https://cve.now/CVE-2020-1772.md): Information Disclosure (CVSS 6.5, OTRS AG ((OTRS)) Community Edition · OTRS AG OTRS) - [CVE-2020-1771](https://cve.now/CVE-2020-1771.md): Possible XSS in Customer user address book (CVSS 4.6, OTRS AG ((OTRS)) Community Edition · OTRS AG OTRS) - [CVE-2020-1770](https://cve.now/CVE-2020-1770.md): Information disclosure in support bundle files (CVSS 2.4, OTRS AG ((OTRS)) Community Edition · OTRS AG OTRS) - [CVE-2020-1769](https://cve.now/CVE-2020-1769.md): Autocomplete in the form login screens (CVSS 3.5, OTRS AG ((OTRS)) Community Edition · OTRS AG OTRS) - [CVE-2020-10510](https://cve.now/CVE-2020-10510.md): Sunnet eHRD - Broken Access Control (CVSS 8.1, Sunnet eHRD) - [CVE-2020-10509](https://cve.now/CVE-2020-10509.md): Sunnet eHRD - Cross-Site Scripting (CVSS 6.1, Sunnet eHRD) - [CVE-2020-10508](https://cve.now/CVE-2020-10508.md): Sunnet eHRD - Sensitive Data Exposure (CVSS 7.5, Sunnet eHRD) - [CVE-2020-3936](https://cve.now/CVE-2020-3936.md): Unisoon UltraLog Express - SQL Injection (CVSS 10.0, Unisoon UltraLog Express) - [CVE-2020-3921](https://cve.now/CVE-2020-3921.md): Unisoon UltraLog Express - Sensitive Data Exposure (CVSS 8.6, Unisoon UltraLog Express) - [CVE-2020-3920](https://cve.now/CVE-2020-3920.md): Unisoon UltraLog Express - Broken Authentication (CVSS 8.1, Unisoon UltraLog Express) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2020-03-27 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.