CVEs published March 30, 2020
34 CVEs were published on March 30, 2020: 0 critical, 2 high.
- Published
- 34
- Critical
- 0
- High
- 2
- Medium
- 5
- Low
- 3
- Unrated
- 24
- Now in CISA KEV
- 0
- Fix available
- 8
Most affected products
- Grandstream UCM6200 series
- 4
- Vertiv Avocent UMG-4000
- 3
- Apache NetBeans · org.codehaus.mevenide:netbeans
- 2
- org.odata4j:odata4j-core · org.odata4j:odata4j-dist +1
- 2
- bson
- 1
- com.gradle.plugin-publish · com.gradle.publish:plugin-pu… +1
- 1
- io.micronaut:micronaut-http-client
- 1
- MELSOFT transmission port (UDP/IP) of multiple Mitsubishi E…
- 1
- symfony · symfony/error-handler +1
- 1
- symfony · symfony/http-foundation +1
- 1
High 2
Medium, low and unrated 32
- CVE-2020-7611All versions of io.micronaut:micronaut-http-client before 1.2.11 and all versions from 1.3.0 before 1.3.2 are vulnerable to HTTP Request Heaio.micronaut:micronaut-http-client
- CVE-2020-11106An issue was discovered in Responsive Filemanager through 9.14.0.
- CVE-2019-19605X-Plane before 11.41 allows Arbitrary Memory Write via crafted network packets, which could cause a denial of service or arbitrary code exec
- CVE-2019-19606X-Plane before 11.41 has multiple improper path validations that could allow reading and writing files from/to arbitrary paths (or a leak of
- CVE-2020-11104An issue was discovered in USC iLab cereal through 1.3.0.
- CVE-2020-11105An issue was discovered in USC iLab cereal through 1.3.0.
- CVE-2019-19912In Intland codeBeamer ALM 9.5 and earlier, a cross-site scripting (XSS) vulnerability in the Upload Flash File feature allows authenticated
- CVE-2019-19913In Intland codeBeamer ALM 9.5 and earlier, there is stored XSS via the Trackers Title parameter.
- CVE-2020-5289Read permissions not enforced for client provided filter expressions in Elide http clientyahoo elide · com.yahoo.elide:elide-core
- CVE-2020-10374A webserver component in Paessler PRTG Network Monitor 19.2.50 to PRTG 20.1.56 allows unauthenticated remote command execution via a crafted
- CVE-2019-20634An issue was discovered in Proofpoint Email Protection through 2019-09-08.
- CVE-2020-9055Versiant Lynx Customer Service Portal version 3.5.2 is vulnerable to stored cross-site scripting, which may allow an attacker to execute arbitrary JavaScriptVersiant LYNX Customer Service Portal
- CVE-2019-9509The web interface of the Vertiv Avocent UMG-4000 version 4.2.1.19 is vulnerable to reflected cross site scriptingVertiv Avocent UMG-4000
- CVE-2019-9508Vertiv Avocent UMG-4000 version 4.2.1.19 web interface is vulnerable to stored cross site scriptingVertiv Avocent UMG-4000
- CVE-2020-5284Directory Traversal in Next.js versions below 9.3.2zeit next.js · next
- CVE-2016-11023odata4j 0.7.0 allows ExecuteCountQueryCommand.java SQL injection.org.odata4j:odata4j-core · org.odata4j:odata4j-dist +1
- CVE-2016-11024odata4j 0.7.0 allows ExecuteJPQLQueryCommand.java SQL injection.org.odata4j:odata4j-core · org.odata4j:odata4j-dist +1
- CVE-2020-5274Exceptions displayed in non-debug configurations in Symfonysymfony · symfony/error-handler +1
- CVE-2020-5255Prevent cache poisoning via a Response Content-Type headersymfony · symfony/http-foundation +1
- CVE-2020-5726The Grandstream UCM6200 series before 1.0.20.22 is vulnerable to an SQL injection via the CTI server on port 8888.Grandstream UCM6200 series
- CVE-2020-5725The Grandstream UCM6200 series before 1.0.20.22 is vulnerable to an SQL injection via the HTTP server's websockify endpoint.Grandstream UCM6200 series
- CVE-2020-5724The Grandstream UCM6200 series before 1.0.20.22 is vulnerable to an SQL injection via the HTTP server's websockify endpoint.Grandstream UCM6200 series
- CVE-2020-5723The UCM6200 series 1.0.20.22 and below stores unencrypted user passwords in an SQLite database.Grandstream UCM6200 series
- CVE-2019-17561The "Apache NetBeans" autoupdate system does not fully validate code signatures.Apache NetBeans · org.codehaus.mevenide:netbeans
- CVE-2019-17560The "Apache NetBeans" autoupdate system does not validate SSL certificates and hostnames for https based downloads.Apache NetBeans · org.codehaus.mevenide:netbeans
- CVE-2020-7610All versions of bson before 1.1.4 are vulnerable to Deserialization of Untrusted Data.bson
- CVE-2020-7599All versions of com.gradle.plugin-publish before 0.11.0 are vulnerable to Insertion of Sensitive Information into Log File.com.gradle.plugin-publish · com.gradle.publish:plugin-pu… +1
- CVE-2020-8509Zoho ManageEngine Desktop Central before 10.0.483 allows unauthenticated users to access PDFGenerationServlet, leading to sensitive informat
- CVE-2019-7755In webERP 4.15, the Import Bank Transactions function fails to sanitize the content of imported MT940 bank statement files, resulting in the
- CVE-2020-10560An issue was discovered in Open Source Social Network (OSSN) through 5.3.
- CVE-2020-5527When MELSOFT transmission port (UDP/IP) of Mitsubishi Electric MELSEC iQ-R series (all versions), MELSEC iQ-F series (all versions), MELSEC MELSOFT transmission port (UDP/IP) of multiple Mitsubishi E…
- CVE-2020-5551Toyota 2017 Model Year DCU (Display Control Unit) allows an unauthenticated attacker within Bluetooth range to cause a denial of service attTOYOTA MOTOR DCU