CVE-2020-10952: GitLab EE/CE 8.11 through 12.9.1 allows blocked users to pull/push docker images.
GitLab EE/CE 8.11 through 12.9.1 allows blocked users to pull/push docker images.
Published Mar 27, 2020 · Updated Aug 4, 2024
CVE archive
March 2020
Browse CVE records published in March 2020, with severity, affected products, CWE, KEV, and source-backed vulnerability context.
Showing 50 of 1453 matching CVEs · Page 10 of 30.
CVE-2020-10938: GraphicsMagick before 1.3.35 has an integer overflow and resultant heap-based buffer overflow in HuffmanDec...
GraphicsMagick before 1.3.35 has an integer overflow and resultant heap-based buffer overflow in HuffmanDecodeImage in magick/compress.c.
Published Mar 24, 2020 · Updated Aug 4, 2024
CVE-2020-10931: Memcached 1.6.x before 1.6.2 allows remote attackers to cause a denial of service (daemon crash) via a craf...
Memcached 1.6.x before 1.6.2 allows remote attackers to cause a denial of service (daemon crash) via a crafted binary protocol header to try_read_command_binary in memcached.c.
Published Mar 24, 2020 · Updated Aug 4, 2024
CVE-2020-10934: Acyba AcyMailing before 6.9.2 mishandles file uploads by admins.
Acyba AcyMailing before 6.9.2 mishandles file uploads by admins.
Published Mar 24, 2020 · Updated Aug 4, 2024
CVE-2020-10939: Insecure, default path permissions in PHOENIX CONTACT PC WORX SRT through 1.14 allow for local privilege es...
Insecure, default path permissions in PHOENIX CONTACT PC WORX SRT through 1.14 allow for local privilege escalation.
Published Mar 27, 2020 · Updated Aug 4, 2024
CVE-2020-10879: rConfig before 3.9.5 allows command injection by sending a crafted GET request to lib/crud/search.crud.php...
rConfig before 3.9.5 allows command injection by sending a crafted GET request to lib/crud/search.crud.php since the nodeId parameter is passed directly to the exec function without being escaped.
Published Mar 23, 2020 · Updated Aug 4, 2024
CVE-2020-10888: This vulnerability allows remote attackers to bypass authentication on affected installations of TP-Link Ar...
This vulnerability allows remote attackers to bypass authentication on affected installations of TP-Link Archer A7 Firmware Ver: 190726 AC1750 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of SSH port forwarding requests during initial setup. The issue results from the lack of proper authentication prior to establishing SSH port forwarding rules. An attacker can leverage this vulnerability to escalate privileges to resources normally protected from the WAN interface. Was ZDI-CAN-9664.
Published Mar 25, 2020 · Updated Aug 4, 2024
CVE-2020-10885: This vulnerability allows remote attackers to execute arbitrary code on affected installations of TP-Link A...
This vulnerability allows remote attackers to execute arbitrary code on affected installations of TP-Link Archer A7 Firmware Ver: 190726 AC1750 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of DNS responses. The issue results from the lack of proper validation of DNS reponses prior to further processing. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of the root user. Was ZDI-CAN-9661.
Published Mar 25, 2020 · Updated Aug 4, 2024
CVE-2020-10854: An issue was discovered on Samsung mobile devices with O(8.x), P(9.0), and Q(10.0) software.
An issue was discovered on Samsung mobile devices with O(8.x), P(9.0), and Q(10.0) software. Kernel stack addresses are leaked to userspace. The Samsung ID is SVE-2019-16161 (January 2020).
Published Mar 24, 2020 · Updated Aug 4, 2024
CVE-2020-10882: This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of...
This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of TP-Link Archer A7 Firmware Ver: 190726 AC1750 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the tdpServer service, which listens on UDP port 20002 by default. When parsing the slave_mac parameter, the process does not properly validate a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of the root user. Was ZDI-CAN-9650.
Published Mar 25, 2020 · Updated Aug 4, 2024
CVE-2020-10855: An issue was discovered on Samsung mobile devices with P(9.0) software.
An issue was discovered on Samsung mobile devices with P(9.0) software. Attackers can bypass Factory Reset Protection (FRP) via AppTray. The Samsung ID is SVE-2019-16192 (January 2020).
Published Mar 24, 2020 · Updated Aug 4, 2024
CVE-2020-10875: Motorola FX9500 devices allow remote attackers to conduct absolute path traversal attacks, as demonstrated...
Motorola FX9500 devices allow remote attackers to conduct absolute path traversal attacks, as demonstrated by PL/SQL Server Pages files such as /include/viewtagdb.psp.
Published Mar 23, 2020 · Updated Aug 4, 2024
CVE-2020-10884: This vulnerability allows network-adjacent attackers execute arbitrary code on affected installations of TP...
This vulnerability allows network-adjacent attackers execute arbitrary code on affected installations of TP-Link Archer A7 Firmware Ver: 190726 AC1750 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the tdpServer service, which listens on UDP port 20002 by default. This issue results from the use of hard-coded encryption key. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of root. Was ZDI-CAN-9652.
Published Mar 25, 2020 · Updated Aug 4, 2024
CVE-2020-10887: This vulnerability allows a firewall bypass on affected installations of TP-Link Archer A7 Firmware Ver: 19...
This vulnerability allows a firewall bypass on affected installations of TP-Link Archer A7 Firmware Ver: 190726 AC1750 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of IPv6 connections. The issue results from the lack of proper filtering of IPv6 SSH connections. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of root. Was ZDI-CAN-9663.
Published Mar 25, 2020 · Updated Aug 4, 2024
CVE-2020-10883: This vulnerability allows local attackers to escalate privileges on affected installations of TP-Link Arche...
This vulnerability allows local attackers to escalate privileges on affected installations of TP-Link Archer A7 Firmware Ver: 190726 AC1750 routers. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the file system. The issue lies in the lack of proper permissions set on the file system. An attacker can leverage this vulnerability to escalate privileges. Was ZDI-CAN-9651.
Published Mar 25, 2020 · Updated Aug 4, 2024
CVE-2020-10870: Zim through 0.72.1 creates temporary directories with predictable names.
Zim through 0.72.1 creates temporary directories with predictable names. A malicious user could predict and create Zim's temporary directories and prevent other users from being able to start Zim, resulting in a denial of service.
Published Mar 23, 2020 · Updated Aug 4, 2024
CVE-2020-10849: An issue was discovered on Samsung mobile devices with O(8.x), P(9.0), and Q(10.0) (Exynos7885, Exynos8895,...
An issue was discovered on Samsung mobile devices with O(8.x), P(9.0), and Q(10.0) (Exynos7885, Exynos8895, and Exynos9810 chipsets) software. The Gatekeeper trustlet allows a brute-force attack on the screen lock password. The Samsung ID is SVE-2019-14575 (January 2020).
Published Mar 24, 2020 · Updated Aug 4, 2024
CVE-2020-10840: An issue was discovered on Samsung mobile devices with P(9.0) and Q(10.0) (Exynos 9610 chipsets) software.
An issue was discovered on Samsung mobile devices with P(9.0) and Q(10.0) (Exynos 9610 chipsets) software. There is a kernel pointer leak in the vipx driver. The Samsung ID is SVE-2019-16293 (February 2020).
Published Mar 24, 2020 · Updated Aug 4, 2024
CVE-2020-10837: An issue was discovered on Samsung mobile devices with P(9.0) and Q(10.0) (with TEEGRIS) software.
An issue was discovered on Samsung mobile devices with P(9.0) and Q(10.0) (with TEEGRIS) software. The Esecomm Trustlet allows a stack overflow and arbitrary code execution. The Samsung ID is SVE-2019-15984 (February 2020).
Published Mar 24, 2020 · Updated Aug 4, 2024
CVE-2020-10852: An issue was discovered on Samsung mobile devices with O(8.x), P(9.0), and Q(10.0) software.
An issue was discovered on Samsung mobile devices with O(8.x), P(9.0), and Q(10.0) software. There is a stack overflow in display driver. The Samsung ID is SVE-2019-15877 (January 2020).
Published Mar 24, 2020 · Updated Aug 4, 2024
CVE-2020-10853: An issue was discovered on Samsung mobile devices with P(9.0) software.
An issue was discovered on Samsung mobile devices with P(9.0) software. Gallery leaks cached data. The Samsung IDs are SVE-2019-16010, SVE-2019-16011, SVE-2019-16012 (January 2020).
Published Mar 24, 2020 · Updated Aug 4, 2024
CVE-2020-10841: An issue was discovered on Samsung mobile devices with P(9.0) and Q(10.0) (Exynos 9610 chipsets) software.
An issue was discovered on Samsung mobile devices with P(9.0) and Q(10.0) (Exynos 9610 chipsets) software. There is an arbitrary kfree in the vipx and vertex drivers. The Samsung ID is SVE-2019-16294 (February 2020).
Published Mar 24, 2020 · Updated Aug 4, 2024
CVE-2020-10848: An issue was discovered on Samsung mobile devices with O(8.x), P(9.0), and Q(10.0) (Exynos 9810 chipsets) s...
An issue was discovered on Samsung mobile devices with O(8.x), P(9.0), and Q(10.0) (Exynos 9810 chipsets) software. Arbitrary memory mapping exists in TEE. The Samsung ID is SVE-2019-16665 (February 2020).
Published Mar 24, 2020 · Updated Aug 4, 2024
CVE-2020-10846: An issue was discovered on Samsung mobile devices with P(9.x) and Q(10.x) software.
An issue was discovered on Samsung mobile devices with P(9.x) and Q(10.x) software. Attackers can enable the OEM unlock feature on a KG-enrolled devices, leading to potentially unwanted binaries being downloaded. The Samsung ID is SVE-2019-16554 (February 2020).
Published Mar 24, 2020 · Updated Aug 4, 2024
CVE-2020-10843: An issue was discovered on Samsung mobile devices with O(8.x), P(9.0), and Q(10.0) (S.LSI chipsets) software.
An issue was discovered on Samsung mobile devices with O(8.x), P(9.0), and Q(10.0) (S.LSI chipsets) software. There are race conditions in the hdcp2 driver. The Samsung ID is SVE-2019-16296 (February 2020).
Published Mar 24, 2020 · Updated Aug 4, 2024
CVE-2020-10809: An issue was discovered in HDF5 through 1.12.0.
An issue was discovered in HDF5 through 1.12.0. A heap-based buffer overflow exists in the function Decompress() located in decompress.c. It can be triggered by sending a crafted file to the gif2h5 binary. It allows an attacker to cause Denial of Service.
Published Mar 22, 2020 · Updated Aug 4, 2024
CVE-2020-10820: Nagios XI 5.6.11 allows XSS via the includes/components/ldap_ad_integration/ password parameter.
Nagios XI 5.6.11 allows XSS via the includes/components/ldap_ad_integration/ password parameter.
Published Mar 22, 2020 · Updated Aug 4, 2024
CVE-2020-10838: An issue was discovered on Samsung mobile devices with P(9.0) and Q(10.0) software.
An issue was discovered on Samsung mobile devices with P(9.0) and Q(10.0) software. PROCA allows a use-after-free and arbitrary code execution. The Samsung ID is SVE-2019-16132 (February 2020).
Published Mar 24, 2020 · Updated Aug 4, 2024
CVE-2020-10871: In OpenWrt LuCI git-20.x, remote unauthenticated attackers can retrieve the list of installed packages and...
In OpenWrt LuCI git-20.x, remote unauthenticated attackers can retrieve the list of installed packages and services. NOTE: the vendor disputes the significance of this report because, for instances reachable by an unauthenticated actor, the same information is available in other (more complex) ways, and there is no plan to restrict the information further
Published Mar 23, 2020 · Updated Aug 4, 2024
CVE-2020-10847: An issue was discovered on Samsung mobile devices with P(9.0) (Galaxy S8 and Note8) software.
An issue was discovered on Samsung mobile devices with P(9.0) (Galaxy S8 and Note8) software. Facial recognition can be spoofed. The Samsung ID is SVE-2019-16614 (February 2020).
Published Mar 24, 2020 · Updated Aug 4, 2024
CVE-2020-10874: Motorola FX9500 devices allow remote attackers to read database files.
Motorola FX9500 devices allow remote attackers to read database files.
Published Mar 23, 2020 · Updated Aug 4, 2024
CVE-2020-10842: An issue was discovered on Samsung mobile devices with O(8.x), P(9.0), and Q(10.0) (S.LSI chipsets) software.
An issue was discovered on Samsung mobile devices with O(8.x), P(9.0), and Q(10.0) (S.LSI chipsets) software. There is a heap out-of-bounds write in the tsmux driver. The Samsung ID is SVE-2019-16295 (February 2020).
Published Mar 24, 2020 · Updated Aug 4, 2024
CVE-2020-10886: This vulnerability allows remote attackers to execute arbitrary code on affected installations of TP-Link A...
This vulnerability allows remote attackers to execute arbitrary code on affected installations of TP-Link Archer A7 Firmware Ver: 190726 AC1750 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the tmpServer service, which listens on TCP port 20002. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-9662.
Published Mar 25, 2020 · Updated Aug 4, 2024
CVE-2020-10845: An issue was discovered on Samsung mobile devices with O(8.x), P(9.0), and Q(10.0) software.
An issue was discovered on Samsung mobile devices with O(8.x), P(9.0), and Q(10.0) software. There is a race condition leading to a use-after-free in MTP. The Samsung ID is SVE-2019-16520 (February 2020).
Published Mar 24, 2020 · Updated Aug 4, 2024
CVE-2020-10881: This vulnerability allows remote attackers to execute arbitrary code on affected installations of TP-Link A...
This vulnerability allows remote attackers to execute arbitrary code on affected installations of TP-Link Archer A7 Firmware Ver: 190726 AC1750 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of DNS responses. A crafted DNS message can trigger an overflow of a fixed-length, stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the root user. Was ZDI-CAN-9660.
Published Mar 25, 2020 · Updated Aug 4, 2024
CVE-2020-10850: An issue was discovered on Samsung mobile devices with O(8.x), P(9.0), and Q(10.0) (Exynos chipsets) software.
An issue was discovered on Samsung mobile devices with O(8.x), P(9.0), and Q(10.0) (Exynos chipsets) software. The secure bootloade has a buffer overflow of the USB buffer, leading to arbitrary code execution. The Samsung ID is SVE-2019-15872 (January 2020).
Published Mar 24, 2020 · Updated Aug 4, 2024
CVE-2020-10832: An issue was discovered on Samsung mobile devices with P(9.0) (Exynos chipsets) software.
An issue was discovered on Samsung mobile devices with P(9.0) (Exynos chipsets) software. Kernel Wi-Fi drivers allow out-of-bounds Read or Write operations (e.g., a buffer overflow). The Samsung IDs are SVE-2019-16125, SVE-2019-16134, SVE-2019-16158, SVE-2019-16159, SVE-2019-16319, SVE-2019-16320, SVE-2019-16337, SVE-2019-16464, SVE-2019-16465, SVE-2019-16467 (March 2020).
Published Mar 24, 2020 · Updated Aug 4, 2024
CVE-2020-10802: In phpMyAdmin 4.x before 4.9.5 and 5.x before 5.0.2, a SQL injection vulnerability has been discovered wher...
In phpMyAdmin 4.x before 4.9.5 and 5.x before 5.0.2, a SQL injection vulnerability has been discovered where certain parameters are not properly escaped when generating certain queries for search actions in libraries/classes/Controllers/Table/TableSearchController.php. An attacker can generate a crafted database or table name. The attack can be performed if a user attempts certain search operations on the malicious database or table.
Published Mar 22, 2020 · Updated Aug 4, 2024
CVE-2020-10803: In phpMyAdmin 4.x before 4.9.5 and 5.x before 5.0.2, a SQL injection vulnerability was discovered where mal...
In phpMyAdmin 4.x before 4.9.5 and 5.x before 5.0.2, a SQL injection vulnerability was discovered where malicious code could be used to trigger an XSS attack through retrieving and displaying results (in tbl_get_field.php and libraries/classes/Display/Results.php). The attacker must be able to insert crafted data into certain database tables, which when retrieved (for instance, through the Browse tab) can trigger the XSS attack.
Published Mar 22, 2020 · Updated Aug 4, 2024
CVE-2020-10821: Nagios XI 5.6.11 allows XSS via the account/main.php theme parameter.
Nagios XI 5.6.11 allows XSS via the account/main.php theme parameter.
Published Mar 22, 2020 · Updated Aug 4, 2024
CVE-2020-10839: An issue was discovered on Samsung mobile devices with O(8.x), P(9.0), and Q(10.0) software.
An issue was discovered on Samsung mobile devices with O(8.x), P(9.0), and Q(10.0) software. Attackers can bypass Factory Reset Protection (FRP) via a SIM card. The Samsung ID is SVE-2019-16193 (February 2020).
Published Mar 24, 2020 · Updated Aug 4, 2024
CVE-2020-10833: An issue was discovered on Samsung mobile devices with Q(10.0) software.
An issue was discovered on Samsung mobile devices with Q(10.0) software. The DeX Lockscreen allows attackers to access the quick panel and notifications. The Samsung ID is SVE-2019-16532 (March 2020).
Published Mar 24, 2020 · Updated Aug 4, 2024
CVE-2020-10790: openITCOCKPIT before 3.7.3 has unnecessary files (such as Lodash files) under the web root, which leads to...
openITCOCKPIT before 3.7.3 has unnecessary files (such as Lodash files) under the web root, which leads to XSS.
Published Mar 25, 2020 · Updated Aug 4, 2024
CVE-2020-10844: An issue was discovered on Samsung mobile devices with O(8.x), P(9.x), and Q(10.0) software.
An issue was discovered on Samsung mobile devices with O(8.x), P(9.x), and Q(10.0) software. There is an out-of-bounds read vulnerability in media.audio_policy. The Samsung ID is SVE-2019-16333 (February 2020).
Published Mar 24, 2020 · Updated Aug 4, 2024
CVE-2020-10810: An issue was discovered in HDF5 through 1.12.0.
An issue was discovered in HDF5 through 1.12.0. A NULL pointer dereference exists in the function H5AC_unpin_entry() located in H5AC.c. It allows an attacker to cause Denial of Service.
Published Mar 22, 2020 · Updated Aug 4, 2024
CVE-2020-10788: openITCOCKPIT before 3.7.3 uses the 1fea123e07f730f76e661bced33a94152378611e API key rather than generating...
openITCOCKPIT before 3.7.3 uses the 1fea123e07f730f76e661bced33a94152378611e API key rather than generating a random API Key for WebSocket connections.
Published Mar 25, 2020 · Updated Aug 4, 2024
CVE-2020-10799: The svglib package through 0.9.3 for Python allows XXE attacks via an svg2rlg call.
The svglib package through 0.9.3 for Python allows XXE attacks via an svg2rlg call.
Published Mar 20, 2020 · Updated Aug 4, 2024
CVE-2020-10808: Vesta Control Panel (VestaCP) through 0.9.8-26 allows Command Injection via the schedule/backup Backup List...
Vesta Control Panel (VestaCP) through 0.9.8-26 allows Command Injection via the schedule/backup Backup Listing Endpoint. The attacker must be able to create a crafted filename on the server, as demonstrated by an FTP session that renames .bash_logout to a .bash_logout' substring followed by shell metacharacters.
Published Mar 22, 2020 · Updated Aug 4, 2024
CVE-2020-10793: CodeIgniter through 4.0.0 allows remote attackers to gain privileges via a modified Email ID to the "Select...
CodeIgniter through 4.0.0 allows remote attackers to gain privileges via a modified Email ID to the "Select Role of the User" page. NOTE: A contributor to the CodeIgniter framework argues that the issue should not be attributed to CodeIgniter. Furthermore, the blog post reference shows an unknown website built with the CodeIgniter framework but that CodeIgniter is not responsible for introducing this issue because the framework has never provided a login screen, nor any kind of login or user management facilities beyond a Session library. Also, another reporter indicates the issue is with a custom module/plugin to CodeIgniter, not CodeIgniter itself.
Published Mar 23, 2020 · Updated Aug 4, 2024
CVE-2020-10829: An issue was discovered on Samsung mobile devices with O(8.0), P(9.0), and Q(10.0) (Broadcom chipsets) soft...
An issue was discovered on Samsung mobile devices with O(8.0), P(9.0), and Q(10.0) (Broadcom chipsets) software. A kernel driver heap overflow leads to arbitrary code execution. The Samsung ID is SVE-2019-15880 (March 2020).
Published Mar 24, 2020 · Updated Aug 4, 2024