Skip to content
OpenAdvisories

Archive

17 March 2020

Vulnerabilities first published on this day (UTC), newest first.

← February 2020 2020 / March /17 April 2020 →
  1. 13
  2. 258
  3. 314
  4. 442
  5. 589
  6. 626
  7. 78
  8. 87
  9. 968
  10. 10144
  11. 1145
  12. 12299
  13. 1375
  14. 1412
  15. 1526
  16. 1689
  17. 1731
  18. 1872
  19. 1978
  20. 2078
  21. 215
  22. 2214
  23. 2362
  24. 24175
  25. 25110
  26. 2630
  27. 2739
  28. 28 
  29. 29 
  30. 3034
  31. 3129
All Critical High Medium Low Exploited only Public exploit

31 results · Feed

  • High 7.8
    CVE-2020-3950 Exploited Public exploit

    VMware Fusion (11.x before 11.5.2), VMware Remote Console for Mac (11.x and prior before 11.0.1) and Horizon Client for…

    KEV Nov 3, 2021
  • Unscored —
    CVE-2020-3951

    VMware Workstation (15.x before 15.5.2) and Horizon Client for Windows (5.x and prior before 5.4.0) contain a denial-of…

    Windows
  • Low 3.1
    CVE-2020-1720

    A flaw was found in PostgreSQL's "ALTER ... DEPENDS ON EXTENSION", where sub-commands did not perform authorization che…

    Red Hat postgresql postgresql15 postgresql-10 Ubuntu Alpine
  • High 8.8
    CVE-2018-21037

    Subrion CMS CSRF Vulnerability

    Subrion CMS 4.1.5 (and possibly earlier versions) allow CSRF to change the administrator password via the panel/members/edit/1 URI.

    intelliants/subrion Packagist
  • Medium 5.4
    CVE-2020-10596 Public exploit

    Cross-site Scripting in OpenCart

    OpenCart 3.0.3.2 allows remote authenticated users to conduct XSS attacks via a crafted filename in the users' image upload section.

    opencart/opencart Packagist
  • Unscored —
    CVE-2020-10122

    cPanel before 84.0.20 allows a webmail or demo account to delete arbitrary files (SEC-547).

  • Unscored —
    CVE-2020-10121

    cPanel before 84.0.20 allows a demo account to achieve code execution via PassengerApps APIs (SEC-546).

  • Unscored —
    CVE-2020-10120

    cPanel before 84.0.20 allows resellers to achieve remote code execution as root via a cpsrvd rsync shell (SEC-545).

  • Unscored —
    CVE-2020-10119

    cPanel before 84.0.20 allows a demo account to achieve remote code execution via a cpsrvd rsync shell (SEC-544).

  • Unscored —
    CVE-2020-10118

    cPanel before 84.0.20 allows a demo account to modify files via Branding API calls (SEC-543).

  • Unscored —
    CVE-2020-10117

    cPanel before 84.0.20 mishandles enforcement of demo checks in the Market UAPI namespace (SEC-542).

  • Unscored —
    CVE-2020-10116

    cPanel before 84.0.20 allows attackers to bypass intended restrictions on features and demo accounts via WebDisk UAPI c…

  • Unscored —
    CVE-2020-10115

    cPanel before 84.0.20, when PowerDNS is used, allows arbitrary code execution as root via dnsadmin. (SEC-537).

  • Unscored —
    CVE-2020-10114

    cPanel before 84.0.20 allows stored self-XSS via the HTML file editor (SEC-535).

  • Unscored —
    CVE-2020-10113

    cPanel before 84.0.20 allows self XSS via a temporary character-set specification (SEC-515).

  • Unscored —
    CVE-2019-20498

    cPanel before 82.0.18 allows WebDAV authentication bypass because the connection-sharing logic is incorrect (SEC-534).

  • Unscored —
    CVE-2019-20497

    cPanel before 82.0.18 allows stored XSS via WHM Backup Restoration (SEC-533).

  • Unscored —
    CVE-2019-20496

    cPanel before 82.0.18 allows attackers to conduct arbitrary chown operations as root during log processing (SEC-532).

  • Unscored —
    CVE-2019-20495

    cPanel before 82.0.18 allows attackers to read an arbitrary database via MySQL dump streaming (SEC-531).

  • Unscored —
    CVE-2019-20494

    In cPanel before 82.0.18, Cpanel::Rand::Get can produce a predictable series of numbers (SEC-525).

  • Unscored —
    CVE-2019-20493

    cPanel before 82.0.18 allows self-XSS because JSON string escaping is mishandled (SEC-520).

  • Unscored —
    CVE-2019-20492

    cPanel before 82.0.18 allows authentication bypass because of misparsing of the format of the password file (SEC-516).

  • Unscored —
    CVE-2019-20490

    cPanel before 82.0.18 allows authentication bypass because webmail usernames are processed inconsistently (SEC-499).

  • Unscored —
    CVE-2018-18576

    The Hustle (aka wordpress-popup) plugin through 6.0.5 for WordPress allows Directory Traversal to obtain a directory li…

  • Unscored —
    CVE-2019-11074

    A Write to Arbitrary Location in Disk vulnerability exists in PRTG Network Monitor 19.1.49 and below that allows attack…

  • Unscored —
    CVE-2020-10380

    RMySQL through 0.10.19 allows SQL Injection.

    rmysql rmysql Debian Ubuntu
  • Unscored —
    CVE-2019-20453

    A problem was found in Pydio Core before 8.2.4 and Pydio Enterprise before 8.2.4. A PHP object injection is present in …

  • Unscored —
    CVE-2019-20452

    A problem was found in Pydio Core before 8.2.4 and Pydio Enterprise before 8.2.4. A PHP object injection is present in …

  • Unscored —
    CVE-2020-6646

    An improper neutralization of input vulnerability in FortiWeb allows a remote authenticated attacker to perform a store…

  • Unscored —
    CVE-2019-20407

    The ConfigureBambooRelease resource in Jira Software and Jira Software Data Center before version 8.6.1 allows authenti…

    Atlassian Jira Software Web / CMS
  • Unscored —
    CVE-2019-20105

    The EditApplinkServlet resource in the Atlassian Application Links plugin before version 5.4.20, from version 6.0.0 bef…

    Atlassian Jira Server and Data Center Application Links Web / CMS