CVEs published March 31, 2020
29 CVEs were published on March 31, 2020: 0 critical, 14 high.
- Published
- 29
- Critical
- 0
- High
- 14
- Medium
- 8
- Low
- 1
- Unrated
- 6
- Now in CISA KEV
- 0
- Fix available
- 12
Most affected products
- IBM Spectrum Protect Plus
- 6
- IBM Tivoli Netcool Impact
- 5
- com.fasterxml.jackson.core:jackson-databind
- 3
- [UNKNOWN] moodle · moodle/moodle
- 1
- [UNKNOWN] pki-core
- 1
- [UNKNOWN] systemd
- 1
- containers bubblewrap
- 1
- Elasticsearch · org.elasticsearch:elasticsearch
- 1
- Integrated Dell Remote Access Controller
- 1
- Leantime
- 1
High 14
- CVE-2020-5344Dell EMC iDRAC7, iDRAC8 and iDRAC9 versions prior to 2.65.65.65, 2.70.70.70, 4.00.00.00 contain a stack-based buffer overflow vulnerability.Integrated Dell Remote Access Controller
- CVE-2020-10696A path traversal flaw was found in Buildah in versions before 1.14.5.Red Hat buildah · github.com/containers/buildah
- CVE-2020-5292Time-based blind injection in LeantimeLeantime
- CVE-2020-5291Privilege escalation in setuid mode via user namespaces in Bubblewrapcontainers bubblewrap
- CVE-2020-1712A heap use-after-free vulnerability was found in systemd before version v245-rc1, where asynchronous Polkit queries are performed while hand[UNKNOWN] systemd
- CVE-2019-14905A vulnerability was found in Ansible Engine versions 2.9.x before 2.9.3, 2.8.x before 2.8.8, 2.7.x before 2.7.16 and earlier, where in AnsibRed Hat Ansible · ansible
- CVE-2020-4242IBM Spectrum Scale and IBM Spectrum Protect Plus 10.1.0 through 10.1.5 could allow a remote authenticated attacker to execute arbitrary commIBM Spectrum Protect Plus
- CVE-2020-4241IBM Spectrum Scale and IBM Spectrum Protect Plus 10.1.0 through 10.1.5 could allow a remote authenticated attacker to execute arbitrary commIBM Spectrum Protect Plus
- CVE-2020-4214IBM Spectrum Protect Plus 10.1.0 through 10.1.5 could allow a remote attacker to arbitrary delete a directory caused by improper validation IBM Spectrum Protect Plus
- CVE-2020-4208IBM Spectrum Protect Plus 10.1.0 through 10.1.5 contains hard-coded credentials, such as a password or cryptographic key, which it uses for IBM Spectrum Protect Plus
- CVE-2020-4206IBM Spectrum Protect Plus 10.1.0 through 10.1.5 could allow a remote attacker to execute arbitrary commands on the system in the context of IBM Spectrum Protect Plus
- CVE-2020-11111FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.accom.fasterxml.jackson.core:jackson-databind
- CVE-2020-11112FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.cocom.fasterxml.jackson.core:jackson-databind
- CVE-2020-11113FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.opcom.fasterxml.jackson.core:jackson-databind
Medium, low and unrated 15
- CVE-2020-7009Elasticsearch versions from 6.7.0 before 6.8.8 and 7.0.0 before 7.6.2 contain a privilege escalation flaw if an attacker is able to create AElasticsearch · org.elasticsearch:elasticsearch
- CVE-2019-13495In firmware version 4.50 of Zyxel XGS2210-52HP, multiple stored cross-site scripting (XSS) issues allows remote authenticated users to injec
- CVE-2020-11441phpMyAdmin 5.0.2 allows CRLF injection, as demonstrated by %0D%0Astring%0D%0A inputs to login form fields causing CRLF sequences to be refle
- CVE-2019-10180A vulnerability was found in all pki-core 10.x.x version, where the Token Processing Service (TPS) did not properly sanitize several paramet[UNKNOWN] pki-core
- CVE-2019-14880A vulnerability was found in Moodle versions 3.7 before 3.7.3, 3.6 before 3.6.7, 3.5 before 3.5.9 and earlier.[UNKNOWN] moodle · moodle/moodle
- CVE-2020-4240IBM Spectrum Protect Plus 10.1.0 through 10.1.5 could allow a remote attacker to traverse directories on the system.IBM Spectrum Protect Plus
- CVE-2020-4239IBM Tivoli Netcool Impact 7.1.0.0 through 7.1.0.17 could allow a remote attacker to obtain sensitive information when a detailed technical eIBM Tivoli Netcool Impact
- CVE-2020-4238IBM Tivoli Netcool Impact 7.1.0.0 through 7.1.0.17 is vulnerable to cross-site request forgery which could allow an attacker to execute maliIBM Tivoli Netcool Impact
- CVE-2020-4237IBM Tivoli Netcool Impact 7.1.0.0 through 7.1.0.17 is vulnerable to cross-site request forgery which could allow an attacker to execute maliIBM Tivoli Netcool Impact
- CVE-2020-4236IBM Tivoli Netcool Impact 7.1.0.0 through 7.1.0.17 could allow an authenticated user to cause a denial of service due to improper content paIBM Tivoli Netcool Impact
- CVE-2020-4235IBM Tivoli Netcool Impact 7.1.0.0 through 7.1.0.17 is vulnerable to cross-site scripting.IBM Tivoli Netcool Impact
- CVE-2020-6008LifterLMS Wordpress plugin version below 3.37.15 is vulnerable to arbitrary file write leading to remote code executionLifterLMS Wordpress Plugin
- CVE-2019-2391JS-bson may incorrectly serialise some requestsMongoDB js-bson · bson
- CVE-2020-10595pam-krb5 before 4.9 has a buffer overflow that might cause remote code execution in situations involving supplemental prompting by a Kerbero
- CVE-2020-11414An issue was discovered in Progress Telerik UI for Silverlight before 2020.1.330.