# CVEs published 2020-03-30 34 CVEs were published on March 30, 2020: 0 critical, 2 high. Days are UTC. - [CVE-2020-7611](https://cve.now/CVE-2020-7611.md): All versions of io.micronaut:micronaut-http-client before 1.2.11 and all versions from 1.3.0 before 1.3.2 are vulnerable to HTTP Request Hea (no CVSS, io.micronaut:micronaut-http-client) - [CVE-2020-11106](https://cve.now/CVE-2020-11106.md): An issue was discovered in Responsive Filemanager through 9.14.0. (no CVSS) - [CVE-2019-19605](https://cve.now/CVE-2019-19605.md): X-Plane before 11.41 allows Arbitrary Memory Write via crafted network packets, which could cause a denial of service or arbitrary code exec (no CVSS) - [CVE-2019-19606](https://cve.now/CVE-2019-19606.md): X-Plane before 11.41 has multiple improper path validations that could allow reading and writing files from/to arbitrary paths (or a leak of (no CVSS) - [CVE-2020-11104](https://cve.now/CVE-2020-11104.md): An issue was discovered in USC iLab cereal through 1.3.0. (no CVSS) - [CVE-2020-11105](https://cve.now/CVE-2020-11105.md): An issue was discovered in USC iLab cereal through 1.3.0. (no CVSS) - [CVE-2019-19912](https://cve.now/CVE-2019-19912.md): In Intland codeBeamer ALM 9.5 and earlier, a cross-site scripting (XSS) vulnerability in the Upload Flash File feature allows authenticated (no CVSS) - [CVE-2019-19913](https://cve.now/CVE-2019-19913.md): In Intland codeBeamer ALM 9.5 and earlier, there is stored XSS via the Trackers Title parameter. (no CVSS) - [CVE-2020-5289](https://cve.now/CVE-2020-5289.md): Read permissions not enforced for client provided filter expressions in Elide http client (CVSS 6.8, yahoo elide · com.yahoo.elide:elide-core) - [CVE-2020-10374](https://cve.now/CVE-2020-10374.md): A webserver component in Paessler PRTG Network Monitor 19.2.50 to PRTG 20.1.56 allows unauthenticated remote command execution via a crafted (no CVSS) - [CVE-2019-20634](https://cve.now/CVE-2019-20634.md): An issue was discovered in Proofpoint Email Protection through 2019-09-08. (CVSS 3.7) - [CVE-2020-9055](https://cve.now/CVE-2020-9055.md): Versiant Lynx Customer Service Portal version 3.5.2 is vulnerable to stored cross-site scripting, which may allow an attacker to execute arbitrary JavaScript (CVSS 3.9, Versiant LYNX Customer Service Portal) - [CVE-2019-9509](https://cve.now/CVE-2019-9509.md): The web interface of the Vertiv Avocent UMG-4000 version 4.2.1.19 is vulnerable to reflected cross site scripting (CVSS 6.3, Vertiv Avocent UMG-4000) - [CVE-2019-9508](https://cve.now/CVE-2019-9508.md): Vertiv Avocent UMG-4000 version 4.2.1.19 web interface is vulnerable to stored cross site scripting (CVSS 6.3, Vertiv Avocent UMG-4000) - [CVE-2019-9507](https://cve.now/CVE-2019-9507.md): The web interface of the Vertiv Avocent UMG-4000 version 4.2.1.19 is vulnerable to arbitrary remote code execution (CVSS 8.3, Vertiv Avocent UMG-4000) - [CVE-2020-5284](https://cve.now/CVE-2020-5284.md): Directory Traversal in Next.js versions below 9.3.2 (CVSS 4.4, zeit next.js · next) - [CVE-2020-5275](https://cve.now/CVE-2020-5275.md): Firewall configured with unanimous strategy was not actually unanimous in symfony/security-http (CVSS 7.6, symfony · symfony/security +2) - [CVE-2016-11023](https://cve.now/CVE-2016-11023.md): odata4j 0.7.0 allows ExecuteCountQueryCommand.java SQL injection. (no CVSS, org.odata4j:odata4j-core · org.odata4j:odata4j-dist +1) - [CVE-2016-11024](https://cve.now/CVE-2016-11024.md): odata4j 0.7.0 allows ExecuteJPQLQueryCommand.java SQL injection. (no CVSS, org.odata4j:odata4j-core · org.odata4j:odata4j-dist +1) - [CVE-2020-5274](https://cve.now/CVE-2020-5274.md): Exceptions displayed in non-debug configurations in Symfony (CVSS 4.6, symfony · symfony/error-handler +1) - [CVE-2020-5255](https://cve.now/CVE-2020-5255.md): Prevent cache poisoning via a Response Content-Type header (CVSS 2.6, symfony · symfony/http-foundation +1) - [CVE-2020-5726](https://cve.now/CVE-2020-5726.md): The Grandstream UCM6200 series before 1.0.20.22 is vulnerable to an SQL injection via the CTI server on port 8888. (no CVSS, Grandstream UCM6200 series) - [CVE-2020-5725](https://cve.now/CVE-2020-5725.md): The Grandstream UCM6200 series before 1.0.20.22 is vulnerable to an SQL injection via the HTTP server's websockify endpoint. (no CVSS, Grandstream UCM6200 series) - [CVE-2020-5724](https://cve.now/CVE-2020-5724.md): The Grandstream UCM6200 series before 1.0.20.22 is vulnerable to an SQL injection via the HTTP server's websockify endpoint. (no CVSS, Grandstream UCM6200 series) - [CVE-2020-5723](https://cve.now/CVE-2020-5723.md): The UCM6200 series 1.0.20.22 and below stores unencrypted user passwords in an SQLite database. (no CVSS, Grandstream UCM6200 series) - [CVE-2019-17561](https://cve.now/CVE-2019-17561.md): The "Apache NetBeans" autoupdate system does not fully validate code signatures. (no CVSS, Apache NetBeans · org.codehaus.mevenide:netbeans) - [CVE-2019-17560](https://cve.now/CVE-2019-17560.md): The "Apache NetBeans" autoupdate system does not validate SSL certificates and hostnames for https based downloads. (no CVSS, Apache NetBeans · org.codehaus.mevenide:netbeans) - [CVE-2020-7610](https://cve.now/CVE-2020-7610.md): All versions of bson before 1.1.4 are vulnerable to Deserialization of Untrusted Data. (no CVSS, bson) - [CVE-2020-7599](https://cve.now/CVE-2020-7599.md): All versions of com.gradle.plugin-publish before 0.11.0 are vulnerable to Insertion of Sensitive Information into Log File. (no CVSS, com.gradle.plugin-publish · com.gradle.publish:plugin-pu… +1) - [CVE-2020-8509](https://cve.now/CVE-2020-8509.md): Zoho ManageEngine Desktop Central before 10.0.483 allows unauthenticated users to access PDFGenerationServlet, leading to sensitive informat (no CVSS) - [CVE-2019-7755](https://cve.now/CVE-2019-7755.md): In webERP 4.15, the Import Bank Transactions function fails to sanitize the content of imported MT940 bank statement files, resulting in the (no CVSS) - [CVE-2020-10560](https://cve.now/CVE-2020-10560.md): An issue was discovered in Open Source Social Network (OSSN) through 5.3. (no CVSS) - [CVE-2020-5527](https://cve.now/CVE-2020-5527.md): When MELSOFT transmission port (UDP/IP) of Mitsubishi Electric MELSEC iQ-R series (all versions), MELSEC iQ-F series (all versions), MELSEC (no CVSS, MELSOFT transmission port (UDP/IP) of multiple Mitsubishi E…) - [CVE-2020-5551](https://cve.now/CVE-2020-5551.md): Toyota 2017 Model Year DCU (Display Control Unit) allows an unauthenticated attacker within Bluetooth range to cause a denial of service att (no CVSS, TOYOTA MOTOR DCU) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2020-03-30 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.