Skip to content
OpenAdvisories

Archive

13 March 2020

Vulnerabilities first published on this day (UTC), newest first.

← February 2020 2020 / March /13 April 2020 →
  1. 13
  2. 258
  3. 314
  4. 442
  5. 589
  6. 626
  7. 78
  8. 87
  9. 968
  10. 10144
  11. 1145
  12. 12299
  13. 1375
  14. 1412
  15. 1526
  16. 1689
  17. 1731
  18. 1872
  19. 1978
  20. 2078
  21. 215
  22. 2214
  23. 2362
  24. 24175
  25. 25110
  26. 2630
  27. 2739
  28. 28 
  29. 29 
  30. 3034
  31. 3129
All Critical High Medium Low Exploited only Public exploit

75 results · Feed

  • Unscored —
    CVE-2019-13395

    The Voo branded NETGEAR CG3700b custom firmware V2.02.03 allows CSRF against all /goform/ URIs. An attacker can modify …

  • Unscored —
    CVE-2020-10073

    GitLab EE 12.4.2 through 12.8.1 allows Denial of Service. It was internally discovered that a potential denial of servi…

  • Unscored —
    CVE-2020-10074

    GitLab 10.1 through 12.8.1 has Incorrect Access Control. A scenario was discovered in which a GitLab account could be t…

    gitlab Ubuntu
  • Unscored —
    CVE-2020-10075

    GitLab 12.5 through 12.8.1 allows HTML Injection. A particular error header was potentially susceptible to injection or…

  • Unscored —
    CVE-2020-10076

    GitLab 12.1 through 12.8.1 allows XSS. A stored cross-site scripting vulnerability was discovered when displaying merge…

  • Unscored —
    CVE-2020-10077

    GitLab EE 3.0 through 12.8.1 allows SSRF. An internal investigation revealed that a particular deprecated service was c…

  • Unscored —
    CVE-2020-10078

    GitLab 12.1 through 12.8.1 allows XSS. The merge request submission form was determined to have a stored cross-site scr…

  • Unscored —
    CVE-2020-10079

    GitLab 7.10 through 12.8.1 has Incorrect Access Control. Under certain conditions where users should have been required…

    gitlab Ubuntu
  • Unscored —
    CVE-2020-10080

    GitLab 8.3 through 12.8.1 allows Information Disclosure. It was possible for certain non-members to access the Contribu…

    gitlab Ubuntu
  • Unscored —
    CVE-2020-10081

    GitLab before 12.8.2 has Incorrect Access Control. It was internally discovered that the LFS import process could poten…

    gitlab Ubuntu
  • Unscored —
    CVE-2020-10082

    GitLab 12.2 through 12.8.1 allows Denial of Service. A denial of service vulnerability impacting the designs for public…

  • Unscored —
    CVE-2020-10083

    GitLab 12.7 through 12.8.1 has Insecure Permissions. Under certain conditions involving groups, project authorization c…

  • Unscored —
    CVE-2020-10084

    GitLab EE 11.6 through 12.8.1 allows Information Disclosure. Sending a specially crafted request to the vulnerability_f…

  • Unscored —
    CVE-2020-10085

    GitLab 12.3.5 through 12.8.1 allows Information Disclosure. A particular view was exposing merge private merge request …

  • Unscored —
    CVE-2020-10086

    GitLab 10.4 through 12.8.1 allows Directory Traversal. A particular endpoint was vulnerable to a directory traversal vu…

  • Unscored —
    CVE-2020-10087

    GitLab before 12.8.2 allows Information Disclosure. Badge images were not being proxied, causing mixed content warnings…

    gitlab Ubuntu
  • Unscored —
    CVE-2020-10088

    GitLab 12.5 through 12.8.1 has Insecure Permissions. Depending on particular group settings, it was possible for invite…

  • Unscored —
    CVE-2020-10089

    GitLab 8.11 through 12.8.1 allows a Denial of Service when using several features to recursively request eachother,

  • Unscored —
    CVE-2020-10090

    GitLab 11.7 through 12.8.1 allows Information Disclosure. Under certain group conditions, group epic information was un…

  • Unscored —
    CVE-2020-10218

    A Blind SQL Injection issue was discovered in Sapplica Sentrifugo 3.2 via the index.php/holidaygroups/add id parameter …

  • Unscored —
    CVE-2020-10091

    GitLab 9.3 through 12.8.1 allows XSS. A cross-site scripting vulnerability was found when viewing particular file types.

  • Unscored —
    CVE-2019-19799

    Zoho ManageEngine Applications Manager before 14600 allows a remote unauthenticated attacker to disclose license relate…

  • Unscored —
    CVE-2020-10092

    GitLab 12.1 through 12.8.1 allows XSS. A cross-site scripting vulnerability was present in a particular view relating t…

  • Unscored —
    CVE-2019-12182

    Directory Traversal in Safescan Timemoto and TA-8000 series version 1.0 allows unauthenticated remote attackers to exec…

  • Unscored —
    CVE-2020-10195

    The popup-builder plugin before 3.64.1 for WordPress allows information disclosure and settings modification, leading t…

  • Unscored —
    CVE-2020-10196

    An XSS vulnerability in the popup-builder plugin before 3.64.1 for WordPress allows remote attackers to inject arbitrar…

  • High 7.9
    CVE-2019-19756

    An internal product security audit of Lenovo XClarity Administrator (LXCA) discovered Windows OS credentials, used to p…

    Lenovo XClarity Administrator (LXCA)
  • Unscored —
    CVE-2020-8571

    StorageGRID (formerly StorageGRID Webscale) versions 10.0.0 through 11.3 prior to 11.2.0.8 and 11.3.0.4 are susceptible…

    NETAPP StorageGRID (formerly StorageGRID Webscale)
  • Unscored —
    CVE-2019-6699

    An improper neutralization of input vulnerability in Fortinet FortiADC 5.3.3 and earlier may allow an attacker to execu…

    Fortinet Fortinet FortiADC Network devices
  • Unscored —
    CVE-2019-16157

    An information exposure vulnerability in Fortinet FortiWeb 6.2.0 CLI and earlier may allow an authenticated user to vie…

    Fortinet Fortinet FortiWeb Network devices
  • Critical 10.0
    CVE-2020-1953

    Remote code execution in Apache Commons Configuration

    Apache Commons Configuration uses a third-party library to parse YAML files which by default allows the instantiation of classes if the YAML includes special statements. Apache Commons Configuration versions 2.2, 2.3, 2.4, 2.5, 2.6 did not change the default …

    Apache Apache Commons Configuration org.apache.commons:commons-configuration2 commons-configuration2 Debian Ubuntu Maven
  • Medium 6.1
    CVE-2020-10544

    Cross-site Scripting in PrimeFaces

    An XSS issue was discovered in tooltip/tooltip.js in PrimeTek PrimeFaces 7.0.11. In a web application using PrimeFaces, an attacker can provide JavaScript code in an input field whose data is later used as a tooltip title without any input validation.

    org.primefaces:primefaces primefaces npm Maven
  • Unscored —
    CVE-2009-5159

    Invision Power Board (aka IPB or IP.Board) 2.x through 3.0.4, when Internet Explorer 5 is used, allows XSS via a .txt a…

  • Unscored —
    CVE-2020-10541 EPSS 10%

    Zoho ManageEngine OpManager before 12.4.179 allows remote code execution via a specially crafted Mail Server Settings v…

  • Unscored —
    CVE-2020-10540

    Untis WebUntis before 2020.9.6 allows CSRF for certain combinations of rights and modules.