Skip to content
OpenAdvisories

Archive

24 March 2020

Vulnerabilities first published on this day (UTC), newest first.

← February 2020 2020 / March /24 April 2020 →
  1. 13
  2. 258
  3. 314
  4. 442
  5. 589
  6. 626
  7. 78
  8. 87
  9. 968
  10. 10144
  11. 1145
  12. 12299
  13. 1375
  14. 1412
  15. 1526
  16. 1689
  17. 1731
  18. 1872
  19. 1978
  20. 2078
  21. 215
  22. 2214
  23. 2362
  24. 24175
  25. 25110
  26. 2630
  27. 2739
  28. 28 
  29. 29 
  30. 3034
  31. 3129
All Critical High Medium Low Exploited only Public exploit

175 results · Feed

  • Unscored —
    CVE-2020-6972

    In Notifier Web Server (NWS) Version 3.50 and earlier, the Honeywell Fire Web Server’s authentication may be bypassed b…

    Honeywell Notifier Web Server (NWS) Version 3.50 and earlier ICS / OT
  • Unscored —
    CVE-2020-10938

    GraphicsMagick before 1.3.35 has an integer overflow and resultant heap-based buffer overflow in HuffmanDecodeImage in …

    graphicsmagick graphicsmagick graphicsmagick Debian Ubuntu Alpine
  • Medium 4.3
    CVE-2020-4309

    IBM Content Navigator 3.0CD could disclose sensitive information to an unauthenticated user which could be used to aid …

    IBM Content Navigator
  • Medium 6.3
    CVE-2020-4253

    IBM Content Navigator 3.0CD does not invalidate session after logout which could allow an authenticated user to imperso…

    IBM Content Navigator
  • Medium 6.1
    CVE-2019-4681

    IBM Tivoli Netcool Impact 7.1.0.0 through 7.1.0.17 is vulnerable to cross-site scripting. This vulnerability allows use…

    IBM Tivoli Netcool Impact
  • Medium 5.9
    CVE-2019-4553

    IBM API Connect V5.0.0.0 through 5.0.8.7iFix3 uses weaker than expected cryptographic algorithms that could allow an at…

    IBM API Connect
  • High 7.5
    GHSA-vg44-fw64-cpjx

    Incorrect Account Used for Signing

    ### Impact Anybody using this library to sign with a BIP44 account other than the first account may be affected. If a user is signing with the first account (i.e. the account at index `0`), or with the legacy MEW/MyCrypto HD path, they are not affected. The v…

    eth-ledger-bridge-keyring @metamask/eth-ledger-bridge-keyring npm
  • Unscored —
    CVE-2020-10934

    Acyba AcyMailing before 6.9.2 mishandles file uploads by admins.

  • Unscored —
    CVE-2020-10931 EPSS 28%

    Memcached 1.6.x before 1.6.2 allows remote attackers to cause a denial of service (daemon crash) via a crafted binary p…

    memcached Debian
  • Unscored —
    CVE-2020-10570

    The Telegram application through 5.12 for Android, when Show Popup is enabled, might allow physically proximate attacke…

  • Critical 9.8
    CVE-2020-1747

    Improper Input Validation in PyYAML

    A vulnerability was discovered in the PyYAML library in versions before 5.3.1, where it is susceptible to arbitrary code execution when it processes untrusted YAML files through the full_load method or with the FullLoader loader. Applications that use the lib…

    Red Hat PyYAML pyyaml pyyaml Debian Azure Linux Alpine PyPI
  • Unscored —
    CVE-2020-9359

    KDE Okular before 1.10.0 allows code execution via an action link in a PDF document.

    okular okular okular Debian Ubuntu Alpine
  • Medium 5.6
    CVE-2020-1744

    Exposure of Sensitive Information in keycloak

    A flaw was found in keycloak before version 9.0.1. When configuring an Conditional OTP Authentication Flow as a post login flow of an IDP, the failure login events for OTP are not being sent to the brute force protection event queue. So BruteForceProtector do…

    Red Hat keycloak org.keycloak:keycloak-core Maven
  • Unscored —
    CVE-2020-10941

    Arm Mbed TLS before 2.16.5 allows attackers to obtain sensitive information (an RSA private key) by measuring cache usa…

    mbedtls mbedtls Debian Ubuntu
  • High 7.9
    CVE-2020-10684

    Code Injection, Race Condition, and Execution with Unnecessary Privileges in Ansible

    A flaw was found in Ansible Engine, all versions 2.7.x, 2.8.x and 2.9.x prior to 2.7.17, 2.8.9 and 2.9.6 respectively, when using ansible_facts as a subkey of itself and promoting it to a variable when inject is enabled, overwriting the ansible_facts after th…

    Red Hat Ansible ansible ansible Debian Ubuntu PyPI