# CVEs published 2020-03-31 29 CVEs were published on March 31, 2020: 0 critical, 14 high. Days are UTC. - [CVE-2020-5344](https://cve.now/CVE-2020-5344.md): Dell EMC iDRAC7, iDRAC8 and iDRAC9 versions prior to 2.65.65.65, 2.70.70.70, 4.00.00.00 contain a stack-based buffer overflow vulnerability. (CVSS 7.0, Integrated Dell Remote Access Controller) - [CVE-2020-10696](https://cve.now/CVE-2020-10696.md): A path traversal flaw was found in Buildah in versions before 1.14.5. (CVSS 8.8, Red Hat buildah · github.com/containers/buildah) - [CVE-2020-7009](https://cve.now/CVE-2020-7009.md): Elasticsearch versions from 6.7.0 before 6.8.8 and 7.0.0 before 7.6.2 contain a privilege escalation flaw if an attacker is able to create A (no CVSS, Elasticsearch · org.elasticsearch:elasticsearch) - [CVE-2020-5292](https://cve.now/CVE-2020-5292.md): Time-based blind injection in Leantime (CVSS 8.7, Leantime) - [CVE-2020-5291](https://cve.now/CVE-2020-5291.md): Privilege escalation in setuid mode via user namespaces in Bubblewrap (CVSS 7.2, containers bubblewrap) - [CVE-2019-13495](https://cve.now/CVE-2019-13495.md): In firmware version 4.50 of Zyxel XGS2210-52HP, multiple stored cross-site scripting (XSS) issues allows remote authenticated users to injec (no CVSS) - [CVE-2020-11441](https://cve.now/CVE-2020-11441.md): phpMyAdmin 5.0.2 allows CRLF injection, as demonstrated by %0D%0Astring%0D%0A inputs to login form fields causing CRLF sequences to be refle (no CVSS) - [CVE-2020-1712](https://cve.now/CVE-2020-1712.md): A heap use-after-free vulnerability was found in systemd before version v245-rc1, where asynchronous Polkit queries are performed while hand (CVSS 7.8, \[UNKNOWN\] systemd) - [CVE-2019-10180](https://cve.now/CVE-2019-10180.md): A vulnerability was found in all pki-core 10.x.x version, where the Token Processing Service (TPS) did not properly sanitize several paramet (CVSS 2.4, \[UNKNOWN\] pki-core) - [CVE-2019-14905](https://cve.now/CVE-2019-14905.md): A vulnerability was found in Ansible Engine versions 2.9.x before 2.9.3, 2.8.x before 2.8.8, 2.7.x before 2.7.16 and earlier, where in Ansib (CVSS 7.3, Red Hat Ansible · ansible) - [CVE-2019-14880](https://cve.now/CVE-2019-14880.md): A vulnerability was found in Moodle versions 3.7 before 3.7.3, 3.6 before 3.6.7, 3.5 before 3.5.9 and earlier. (CVSS 4.8, \[UNKNOWN\] moodle · moodle/moodle) - [CVE-2020-4242](https://cve.now/CVE-2020-4242.md): IBM Spectrum Scale and IBM Spectrum Protect Plus 10.1.0 through 10.1.5 could allow a remote authenticated attacker to execute arbitrary comm (CVSS 8.8, IBM Spectrum Protect Plus) - [CVE-2020-4241](https://cve.now/CVE-2020-4241.md): IBM Spectrum Scale and IBM Spectrum Protect Plus 10.1.0 through 10.1.5 could allow a remote authenticated attacker to execute arbitrary comm (CVSS 7.5, IBM Spectrum Protect Plus) - [CVE-2020-4240](https://cve.now/CVE-2020-4240.md): IBM Spectrum Protect Plus 10.1.0 through 10.1.5 could allow a remote attacker to traverse directories on the system. (CVSS 4.8, IBM Spectrum Protect Plus) - [CVE-2020-4239](https://cve.now/CVE-2020-4239.md): IBM Tivoli Netcool Impact 7.1.0.0 through 7.1.0.17 could allow a remote attacker to obtain sensitive information when a detailed technical e (CVSS 5.3, IBM Tivoli Netcool Impact) - [CVE-2020-4238](https://cve.now/CVE-2020-4238.md): IBM Tivoli Netcool Impact 7.1.0.0 through 7.1.0.17 is vulnerable to cross-site request forgery which could allow an attacker to execute mali (CVSS 4.3, IBM Tivoli Netcool Impact) - [CVE-2020-4237](https://cve.now/CVE-2020-4237.md): IBM Tivoli Netcool Impact 7.1.0.0 through 7.1.0.17 is vulnerable to cross-site request forgery which could allow an attacker to execute mali (CVSS 4.3, IBM Tivoli Netcool Impact) - [CVE-2020-4236](https://cve.now/CVE-2020-4236.md): IBM Tivoli Netcool Impact 7.1.0.0 through 7.1.0.17 could allow an authenticated user to cause a denial of service due to improper content pa (CVSS 6.5, IBM Tivoli Netcool Impact) - [CVE-2020-4235](https://cve.now/CVE-2020-4235.md): IBM Tivoli Netcool Impact 7.1.0.0 through 7.1.0.17 is vulnerable to cross-site scripting. (CVSS 5.4, IBM Tivoli Netcool Impact) - [CVE-2020-4214](https://cve.now/CVE-2020-4214.md): IBM Spectrum Protect Plus 10.1.0 through 10.1.5 could allow a remote attacker to arbitrary delete a directory caused by improper validation (CVSS 7.5, IBM Spectrum Protect Plus) - [CVE-2020-4208](https://cve.now/CVE-2020-4208.md): IBM Spectrum Protect Plus 10.1.0 through 10.1.5 contains hard-coded credentials, such as a password or cryptographic key, which it uses for (CVSS 7.5, IBM Spectrum Protect Plus) - [CVE-2020-4206](https://cve.now/CVE-2020-4206.md): IBM Spectrum Protect Plus 10.1.0 through 10.1.5 could allow a remote attacker to execute arbitrary commands on the system in the context of (CVSS 7.5, IBM Spectrum Protect Plus) - [CVE-2020-6008](https://cve.now/CVE-2020-6008.md): LifterLMS Wordpress plugin version below 3.37.15 is vulnerable to arbitrary file write leading to remote code execution (no CVSS, LifterLMS Wordpress Plugin) - [CVE-2019-2391](https://cve.now/CVE-2019-2391.md): JS-bson may incorrectly serialise some requests (CVSS 4.2, MongoDB js-bson · bson) - [CVE-2020-10595](https://cve.now/CVE-2020-10595.md): pam-krb5 before 4.9 has a buffer overflow that might cause remote code execution in situations involving supplemental prompting by a Kerbero (no CVSS) - [CVE-2020-11414](https://cve.now/CVE-2020-11414.md): An issue was discovered in Progress Telerik UI for Silverlight before 2020.1.330. (no CVSS) - [CVE-2020-11111](https://cve.now/CVE-2020-11111.md): FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.ac (CVSS 8.8, com.fasterxml.jackson.core:jackson-databind) - [CVE-2020-11112](https://cve.now/CVE-2020-11112.md): FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.co (CVSS 8.8, com.fasterxml.jackson.core:jackson-databind) - [CVE-2020-11113](https://cve.now/CVE-2020-11113.md): FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.op (CVSS 8.8, com.fasterxml.jackson.core:jackson-databind) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2020-03-31 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.