CVEs published in March 2020
1,760 vulnerabilities, 318 critical, 19 exploited.
- themerex addons, aldo-gutenberg wordpress blog theme, amuli +60 more +62 moreThe ThemeREX Addons plugin before 2020-03-09 for WordPress lacks access control on the ...9.8 Critical
- dell digital delivery, digital delivery (cirrus) +1 moreDell Digital Delivery versions prior to 3.5.2015 contain an incorrect default permissions...7.8 High
- meinbwa direx-pro firmwareBWA DiREX-Pro 1.2181 devices allow remote attackers to discover passwords via a direct request to...7.5 High
- meinbwa direx-pro firmwareBWA DiREX-Pro 1.2181 devices allow full path disclosure via an invalid name array parameter to...5.3 Medium
- meinbwa direx-pro firmwareBWA DiREX-Pro 1.2181 devices allow remote attackers to execute arbitrary OS commands via shell...9.8 Critical
- jpaseto project jpasetoJPaseto before 0.3.0 generates weak hashes when using v2.local tokens.7.5 High
- halvotec raquestAn issue was discovered in Halvotec RAQuest 10.23.10801.0. The login page is vulnerable to...7.5 High
- misp-project mispMISP 2.4.122 has reflected XSS via unsanitized URL parameters. This is related to app/View/Users...6.1 Medium
- misp-project mispMISP 2.4.122 has Persistent XSS in the sighting popover tool. This is related to app/View...6.1 Medium
- livezillaAn issue was discovered in chat.php in LiveZilla Live Chat 8.0.1.3 (Helpdesk). A blind JavaScript...9.6 Critical
- munkireport project munkireportAn issue was discovered in MunkiReport before 5.3.0. An authenticated user could achieve SQL...8.8 High
- munkireport project munkireportAn issue was discovered in MunkiReport before 5.3.0. An authenticated actor can send a custom XSS...5.4 Medium
- munkireport project munkireportAn issue was discovered in Munkireport before 5.3.0.3923. An unauthenticated actor can send a...6.1 Medium
- lexmark 25xxn firmware, 6500e firmware, c510 firmware +81 more +83 moreLexmark X, W, T, E, C, 6500e, and 25xxN devices before 2011-11-15 allow attackers to obtain...7.5 High
- lexmark c540 firmware, c543 firmware, c544 firmware +30 more +32 moreLexmark X, W, T, E, and C devices before 2012-02-09 allow attackers to obtain sensitive...5.3 Medium
- lexmark markvision enterpriseLexmark Markvision Enterprise before 2.3.0 misuses the Apache Commons Collections Library,...8.8 High
- hcl software connectionsHCL Connections v5.5, v6.0, and v6.5 are vulnerable to cross-site scripting. This vulnerability...5.4 Medium
- avast antitrack, avg antitrack +1 moreAvast AntiTrack before 1.5.1.172 and AVG Antitrack before 2.0.0.178 proxies traffic to HTTPS...7.4 High
- lexmark markvision enterpriseLexmark Markvision Enterprise (MVE) before 2.4.1 allows remote attackers to execute arbitrary...10.0 Critical
- zoho password manager pro (pmp), zohocorp manageengine password manager pro +1 moreIn ZOHO Password Manager Pro (PMP) 8.3.0 (Build 8303) and 8.4.0 (Build 8400,8401,8402),...6.5 Medium
- magento advanced newsletterSQL Injection exists in Advanced Newsletter Magento extension before 2.3.5 via the /store...9.8 Critical
- acyba acymailingSQL Injection exists in AcyMailing Joomla Component before 4.9.5 via exportgeolocorder in a...7.2 High
- widgetfactorylimited jceJCE Joomla Component 2.5.0 to 2.5.2 allows arbitrary file upload via a .php file extension for an...8.8 High
- gwesystems jeventsJEvents Joomla Component before 3.4.0 RC6 has SQL Injection via evid in a Manage Events action.7.2 High
- joobi jnewsJNews Joomla Component before 8.5.0 allows arbitrary File Upload via Subscribers or Templates, as...8.8 High
- joobi jnewsJNews Joomla Component before 8.5.0 allows SQL injection via upload thumbnail, Queue Search Field...7.2 High
- vega project vegaImproperly Controlled Modification of Dynamically-Determined Object Attributes in vega-util4.3 Medium
- micro focus international service managerThere is an improper restriction of rendered UI layers or frames vulnerability in Micro Focus...5.4 Medium
- bookstackapp bookstackRemote Code Execution Through Image Uploads in BookStack7.9 High
- red hat ansible, redhat ansible engine, ansible tower +2 morePath Traversal in Ansible7.5 High
- froxlorFroxlor arbitrary code execution via the database configuration options8.8 High
- froxlorFroxlor Exposure of Sensitive Information to an Unauthorized Actor5.5 Medium
- froxlorFroxlor Information Disclosure6.1 Medium
- jenkins cryptomove, jenkins project cryptomove plugin +1 moreOS command injection in CryptoMove Plugin8.8 High
- jenkins literate, jenkins project literate plugin +1 moreRemote Code Execution vulnerability in Jenkins Literate Plugin8.8 High
- jenkins skytap cloud ci, jenkins project skytap cloud ci plugin +1 moreCredentials transmitted in plain text by Skytap Cloud CI Plugin4.3 Medium
- jenkins deployhub, jenkins project deployhub plugin +1 moreCredentials transmitted in plain text by Jenkins DeployHub Plugin4.3 Medium
- jenkins openshift deployer, jenkins project openshift deployer plugin +1 moreCredentials transmitted in plain text by OpenShift Deployer Plugin5.3 Medium
- jenkins zephyr for jira test management, jenkins project zephyr for jira test management plugin +1 moreJenkins Zephyr for JIRA Test Management Plugin stores credentials in plain text5.5 Medium
- jenkins backlog, jenkins project backlog plugin +1 moreCredentials transmitted in plain text by Backlog Plugin4.3 Medium
- jenkins subversion release manager, jenkins project subversion release manager plugin +1 moreJenkins Subversion Release Manager Plugin vulnerable to cross-site scripting (XSS)6.1 Medium
- jenkins quality gates, jenkins project quality gates plugin +1 moreJenkins Quality Gates Plugin transmits credentials in plain text during configuration5.3 Medium
- jenkins sonar quality gates, jenkins project sonar quality gates plugin +1 moreJenkins Sonar Quality Gates Plugin transmits credentials in plain text during configuration5.3 Medium
- jenkins repository connector, jenkins project repository connector plugin +1 moreCredentials transmitted in plain text by Repository Connector Plugin5.3 Medium
- jenkins mac, jenkins project mac plugin +1 moreMissing permission checks in Mac Plugin4.3 Medium
- jenkins mac, jenkins project mac plugin +1 moreCSRF vulnerability in Mac Plugin4.3 Medium
- jenkins mac, jenkins project mac plugin +1 moreMissing SSH host key validation in Mac Plugin7.4 High
- jenkins zephyr enterprise test management, jenkins project zephyr enterprise test management plugin +1 moreCredentials stored in plain text by Zephyr Enterprise Test Management Plugin5.5 Medium
- jenkins rundeck, jenkins project rundeck plugin +1 moreXXE vulnerability in Rundeck Plugin7.1 High
- jenkins logstash, jenkins project logstash plugin +1 moreCredentials transmitted in plain text by Jenkins Logstash Plugin5.3 Medium
- Show moreLoading…