Skip to content
OpenAdvisories

Archive

March 2020

Vulnerabilities first published in this month (UTC), newest first.

← February 2020 2020 / March April 2020 →
  1. 13
  2. 258
  3. 314
  4. 442
  5. 589
  6. 626
  7. 78
  8. 87
  9. 968
  10. 10144
  11. 1145
  12. 12299
  13. 1375
  14. 1412
  15. 1526
  16. 1689
  17. 1731
  18. 1872
  19. 1978
  20. 2078
  21. 215
  22. 2214
  23. 2362
  24. 24175
  25. 25110
  26. 2630
  27. 2739
  28. 28 
  29. 29 
  30. 3034
  31. 3129
All Critical High Medium Low Exploited only Public exploit

13 results · Clear filters · Feed

  • Critical 9.8
    CVE-2020-5722 Exploited Public exploit Scanner template EPSS 84%

    The HTTP interface of the Grandstream UCM6200 series is vulnerable to an unauthenticated remote SQL injection via craft…

    KEV Jan 28, 2022
  • Critical 9.8
    CVE-2020-7961 Exploited Public exploit Scanner template EPSS 100%

    Deserialization of Untrusted Data in Liferay Portal

    Deserialization of Untrusted Data in Liferay Portal prior to 7.2.1 CE GA2 allows remote attackers to execute arbitrary code via JSON web services (JSONWS).

    com.liferay.portal:com.liferay.portal.kernel Maven
    KEV Nov 3, 2021
  • Critical 9.8
    CVE-2020-5847 Exploited Public exploit Scanner template EPSS 96%

    Unraid through 6.8.0 allows Remote Code Execution.

    KEV Nov 3, 2021
  • Critical 9.8
    CVE-2019-19208 Public exploit EPSS 19%

    Code injection in codiad

    Codiad Web IDE through 2.8.4 allows PHP Code injection.

    codiad/codiad Packagist
  • Critical 9.8
    CVE-2020-7602 Public exploit

    OS Command Injection in node-prompt-here

    node-prompt-here through 1.0.1 allows execution of arbitrary commands. The "runCommand()" is called by "getDevices()" function in file "linux/manager.js", which is required by the "index. process.env.NM_CLI" in the file "linux/manager.js". This function is us…

    node-prompt-here npm
  • Critical 10.0
    CVE-2020-0796 Exploited · Ransomware Public exploit Scanner template EPSS 100%

    A remote code execution vulnerability exists in the way that the Microsoft Server Message Block 3.1.1 (SMBv3) protocol …

    Microsoft Windows 10 Version 1903 for x64-based Systems Windows Server, version 1903 (Server Core installation) Windows 10 Version 1903 for ARM64-based Systems Windows
    KEV Feb 10, 2022
  • Critical 9.8
    CVE-2020-1947 Public exploit EPSS 34%

    Deserialization of Untrusted Data in Apache ShardingSphere

    In Apache ShardingSphere(incubator) 4.0.0-RC3 and 4.0.0, the ShardingSphere's web console uses the SnakeYAML library for parsing YAML inputs to load datasource configuration. SnakeYAML allows to unmarshal data to a Java type By using the YAML tag. Unmarshalli…

    Apache Software Foundation Apache ShardingSphere(incubator) org.apache.shardingsphere:shardingsphere Maven
  • Critical 10.0
    CVE-2020-6207 Exploited Public exploit Scanner template EPSS 98%

    SAP Solution Manager (User Experience Monitoring), version- 7.2, due to Missing Authentication Check does not perform a…

    SAP SAP Solution Manager (User Experience Monitoring)
    KEV Nov 3, 2021
  • Critical 9.8
    CVE-2020-10257 Public exploit Scanner template

    The ThemeREX Addons plugin before 2020-03-09 for WordPress lacks access control on the /trx_addons/v2/get/sc_layout RES…

  • Critical 9.8
    CVE-2020-10189 Exploited Public exploit Scanner template EPSS 100%

    Zoho ManageEngine Desktop Central before 10.0.474 allows remote code execution because of deserialization of untrusted …

    KEV Nov 3, 2021
  • Critical 9.8
    CVE-2020-9054 Exploited Public exploit Scanner template EPSS 100%

    ZyXEL NAS products running firmware version 5.21 and earlier are vulnerable to pre-authentication command injection in weblogin.cgi

    Multiple ZyXEL network-attached storage (NAS) devices running firmware version 5.21 contain a pre-authentication command injection vulnerability, which may allow a remote, unauthenticated attacker to execute arbitrary code on a vulnerable device. ZyXEL NAS de…

    Zyxel NSA310 NAS326 NSA320S Network devices
    KEV Mar 25, 2022
  • Critical 9.8
    CVE-2020-9547 Public exploit Scanner template EPSS 18%

    jackson-databind mishandles the interaction between serialization gadgets and typing

    FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to com.ibatis.sqlmap.engine.transaction.jta.JtaTransactionConfig (aka ibatis-sqlmap).

    jackson-databind com.fasterxml.jackson.core:jackson-databind jackson-databind Debian Ubuntu Maven
  • Critical 9.8
    CVE-2020-9548 Public exploit Scanner template EPSS 19%

    jackson-databind mishandles the interaction between serialization gadgets and typing

    FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to br.com.anteros.dbcp.AnterosDBCPConfig (aka anteros-core).

    com.fasterxml.jackson.core:jackson-databind jackson-databind jackson-databind Debian Ubuntu Maven