CVEs published April 22, 2020
127 CVEs were published on April 22, 2020: 6 critical, 59 high. Browse them by severity, product and exploitation status.
- Published
- 127
- Critical
- 6
- High
- 59
- Medium
- 29
- Low
- 4
- Unrated
- 29
- Now in CISA KEV
- 0
- Fix available
- 7
Most affected products
- Foxit PhantomPDF
- 21
- ABB TG/S 3.2 Telephone Gateway · Busch-Jaeger 6186/11 Telef…
- 4
- Foxit Reader
- 4
- Canonical Apport
- 2
- EcoStruxure Machine Expert (all versions)SoMachine, SoMachi…
- 2
- VEEAM One Agent
- 2
- "HCL Connections"
- 1
- ABB System 800xA Base
- 1
- ABB System 800xA Information Manager
- 1
- Alanaktion Phproject
- 1
Critical 6
- CVE-2020-10915This vulnerability allows remote attackers to execute arbitrary code on affected installations of VEEAM One Agent 9.5.4.4587.VEEAM One Agent
- CVE-2020-10914This vulnerability allows remote attackers to execute arbitrary code on affected installations of VEEAM One Agent 9.5.4.4587.VEEAM One Agent
- CVE-2020-7489A CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability exists on…SoMachine Basic (all versions)EcoStruxure Machine Expert –…
- CVE-2020-11011RCE via file upload in PhprojectAlanaktion Phproject
- CVE-2019-19106ABB/Busch-Jaeger Telephone Gateway TG/S 3.2 Access Control issuesABB TG/S 3.2 Telephone Gateway · Busch-Jaeger 6186/11 Telef…
- CVE-2019-19104ABB/Busch-Jaeger Telephone Gateway TG/S 3.2 Improper Authentication and Access ControlABB TG/S 3.2 Telephone Gateway · Busch-Jaeger 6186/11 Telef…
High 59
- CVE-2020-10913This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.7.0.29478.Foxit PhantomPDF
- CVE-2020-10911This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.7.0.29478.Foxit PhantomPDF
- CVE-2020-10912This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.7.0.29478.Foxit PhantomPDF
- CVE-2020-10908This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.7.0.29478.Foxit PhantomPDF
- CVE-2020-10909This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.7.0.29478.Foxit PhantomPDF
- CVE-2020-10910This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.7.0.29478.Foxit PhantomPDF
- CVE-2020-10906This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 9.7.1.29511.Foxit Reader
- CVE-2020-10907This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 9.7.1.29511.Foxit Reader
- CVE-2020-10904This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.7.1.29511.Foxit PhantomPDF
- CVE-2020-10902This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.7.1.29511.Foxit PhantomPDF
- CVE-2020-10900This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 9.7.1.29511.Foxit Reader
- CVE-2020-10898This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.7.1.29511.Foxit PhantomPDF
- CVE-2020-10899This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 9.7.1.29511.Foxit Reader
- CVE-2020-10896This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.7.1.29511.Foxit PhantomPDF
- CVE-2020-10897This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.7.1.29511.Foxit PhantomPDF
- CVE-2020-10893This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.7.1.29511.Foxit PhantomPDF
- CVE-2020-10895This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.7.1.29511.Foxit PhantomPDF
- CVE-2020-10891This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.7.0.29478.Foxit PhantomPDF
- CVE-2020-10892This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.7.0.29478.Foxit PhantomPDF
- CVE-2020-10889This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.7.0.29478.Foxit PhantomPDF
- CVE-2020-10890This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.7.0.29478.Foxit PhantomPDF
- CVE-2020-1983libslirp: use after free vulnerability cause a denial of service.libslirp
- CVE-2020-7488A CWE-319: Cleartext Transmission of Sensitive Information vulnerability exists which could leak sensitive information transmitted between…EcoStruxure Machine Expert (all versions)SoMachine, SoMachi…
- CVE-2018-21130Certain NETGEAR devices are affected by command injection by an unauthenticated attacker.
- CVE-2018-21129Certain NETGEAR devices are affected by disclosure of sensitive information.
Show all 59 entriesShow fewer entries
- CVE-2018-21128Certain NETGEAR devices are affected by authentication bypass.
- CVE-2018-21127Certain NETGEAR devices are affected by command injection by an unauthenticated attacker.
- CVE-2017-18752Certain NETGEAR devices are affected by an attacker's ability to read arbitrary files.
- CVE-2017-18755Certain NETGEAR devices are affected by CSRF.
- CVE-2017-18756Certain NETGEAR devices are affected by incorrect configuration of security settings.
- CVE-2017-18758Certain NETGEAR devices are affected by a stack-based buffer overflow by an authenticated user.
- CVE-2018-21126Certain NETGEAR devices are affected by command injection by an unauthenticated attacker.
- CVE-2018-21125NETGEAR WAC510 devices before 5.0.0.17 are affected by authentication bypass.
- CVE-2018-21124NETGEAR WAC510 devices before 5.0.0.17 are affected by privilege escalation.
- CVE-2018-21123Certain NETGEAR devices are affected by command injection by an unauthenticated attacker.
- CVE-2017-18762Certain NETGEAR devices are affected by command injection by an unauthenticated attacker.
- CVE-2017-18763Certain NETGEAR devices are affected by incorrect configuration of security settings.
- CVE-2017-18764Certain NETGEAR devices are affected by command injection by an unauthenticated attacker.
- CVE-2017-18766Certain NETGEAR devices are affected by an attacker's ability to read arbitrary files.
- CVE-2017-18768Certain NETGEAR devices are affected by CSRF.
- CVE-2020-10712A flaw was found in OpenShift Container Platform version 4.1 and later.Red Hat openshift/cluster-image-registry-operator
- CVE-2018-21121Certain NETGEAR devices are affected by authentication bypass.
- CVE-2018-21118NETGEAR XR500 devices before 2.3.2.32 are affected by authentication bypass.
- CVE-2018-21117NETGEAR XR500 devices before 2.3.2.32 are affected by remote code execution by unauthenticated attackers via the traceroute handler.
- CVE-2018-21116NETGEAR XR500 devices before 2.3.2.32 are affected by remote code execution by unauthenticated attackers.
- CVE-2017-18772Certain NETGEAR devices are affected by authentication bypass.
- CVE-2020-8477ABB System 800xA Information Manager Remote Code ExecutionABB System 800xA Information Manager
- CVE-2018-21115NETGEAR XR500 devices before 2.3.2.32 are affected by remote code execution by unauthenticated attackers.
- CVE-2017-18775Certain NETGEAR devices are affected by CSRF.
- CVE-2017-18776Certain NETGEAR devices are affected by authentication bypass.
- CVE-2017-18777Certain NETGEAR devices are affected by administrative password disclosure.
- CVE-2017-18778Certain NETGEAR devices are affected by incorrect configuration of security settings.
- CVE-2018-21113Certain NETGEAR devices are affected by command injection by an unauthenticated attacker.
- CVE-2017-18779Certain NETGEAR devices are affected by a buffer overflow.
- CVE-2017-18781Certain NETGEAR devices are affected by CSRF.
- CVE-2017-18782Certain NETGEAR devices are affected by CSRF.
- CVE-2017-18786Certain NETGEAR devices are affected by command injection.
- CVE-2020-8474ABB System 800xA Weak Registry PermissionsABB System 800xA Base
- CVE-2017-18787Certain NETGEAR devices are affected by command injection.
Medium, low and unrated 62
- CVE-2020-7350Metasploit Framework Plugin Libnotify Command InjectionRapid7 Metasploit Framework
- CVE-2020-8833Apport race condition in crash report permissionsCanonical Apport
- CVE-2020-8831World writable root owned lock file created in user controllable locationCanonical Apport
- CVE-2020-8867This vulnerability allows remote attackers to create a denial-of-service condition on affected installations of OPC Foundation UA .NET…OPC Foundation UA .NET Standard · OPCFoundation.NetStandard…
- CVE-2020-10905This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit PhantomPDF 9.7.1.29511.Foxit PhantomPDF
- CVE-2020-10903This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit PhantomPDF 9.7.1.29511.Foxit PhantomPDF
- CVE-2020-10901This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit PhantomPDF 9.7.1.29511.Foxit PhantomPDF
- CVE-2020-10894This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit PhantomPDF 9.7.1.29511.Foxit PhantomPDF
- CVE-2018-21151Certain NETGEAR devices are affected by a buffer overflow by an authenticated user.
- CVE-2018-21150Certain NETGEAR devices are affected by a stack-based buffer overflow by an authenticated user.
- CVE-2020-11649An issue was discovered in GitLab CE and EE 8.15 through 12.9.2.
- CVE-2020-11506An issue was discovered in GitLab 10.7.0 and later through 12.9.2.
- CVE-2020-11505An issue was discovered in GitLab Community Edition (CE) and Enterprise Edition (EE) before 12.7.9, 12.8.x before 12.8.9, and 12.9.x…
- CVE-2020-7487A CWE-345: Insufficient Verification of Data Authenticity vulnerability exists which could allow the attacker to execute malicious code on…EcoStruxure Machine Expert (all versions)SoMachine, SoMachi…
- CVE-2020-7490A CWE-426: Untrusted Search Path vulnerability exists in Vijeo Designer Basic (V1.1 HotFix 15 and prior) and Vijeo Designer (V6.9 SP9 and…Vijeo Designer Basic (V1.1 HotFix 15 and prior) and Vijeo D…
- CVE-2019-6859A CWE-798: Use of Hardcoded Credentials vulnerability exists in Modicon Controllers (All versions of the following CPUs and Communication…Modicon Controllers
- CVE-2018-18405jQuery v2.2.2 allows XSS via a crafted onerror attribute of an IMG element.
- CVE-2020-7055An issue was discovered in Elementor 2.7.4.
- CVE-2020-12066CServer::SendMsg in engine/server/server.cpp in Teeworlds 0.7.x before 0.7.5 allows remote attackers to shut down the server.
- CVE-2019-20787Teeworlds before 0.7.4 has an integer overflow when computing a tilemap size.
- CVE-2017-18754Certain NETGEAR devices are affected by command injection by an authenticated user.
- CVE-2017-18757Certain NETGEAR devices are affected by incorrect configuration of security settings.
- CVE-2017-18759Certain NETGEAR devices are affected by a stack-based buffer overflow by an authenticated user.
- CVE-2017-18761NETGEAR R8000 devices before 1.0.4.2 are affected by a stack-based buffer overflow by an authenticated user.
- CVE-2017-18765Certain NETGEAR devices are affected by denial of service.
Show all 62 entriesShow fewer entries
- CVE-2017-18767Certain NETGEAR devices are affected by command injection by an authenticated user.
- CVE-2018-21122Certain NETGEAR devices are affected by denial of service.
- CVE-2020-7642lazysizes through 5.2.0 allows execution of malicious JavaScript.lazysizes
- CVE-2018-21120Certain NETGEAR devices are affected by CSRF.
- CVE-2018-21119Certain NETGEAR devices are affected by command injection by an authenticated user.
- CVE-2020-5740Improper Input Validation in Plex Media Server on Windows allows a local, unauthenticated attacker to execute arbitrary Python code with…Plex Media Server
- CVE-2017-18769Certain NETGEAR devices are affected by an attacker's ability to read arbitrary files.
- CVE-2020-4085"HCL Connections is vulnerable to possible information leakage and could disclose sensitive information via stack trace to a local user.""HCL Connections"
- CVE-2017-18770Certain NETGEAR devices are affected by a buffer overflow by an authenticated user.
- CVE-2017-18773Certain NETGEAR devices are affected by command injection by an authenticated user.
- CVE-2018-21114Certain NETGEAR devices are affected by command injection by an authenticated user.
- CVE-2019-19107ABB/Busch-Jaeger Telephone Gateway TG/S 3.2 Information ExposureABB TG/S 3.2 Telephone Gateway · Busch-Jaeger 6186/11 Telef…
- CVE-2017-18780Certain NETGEAR devices are affected by denial of service.
- CVE-2019-19105ABB/Busch-Jaeger Telephone Gateway TG/S 3.2 Plaintext storing of credentialsABB TG/S 3.2 Telephone Gateway · Busch-Jaeger 6186/11 Telef…
- CVE-2017-18783Certain NETGEAR devices are affected by XSS.
- CVE-2017-18784Certain NETGEAR devices are affected by XSS.
- CVE-2018-21112Certain NETGEAR devices are affected by command injection by an authenticated user.
- CVE-2018-21111Certain NETGEAR devices are affected by a stack-based buffer overflow by an authenticated user.
- CVE-2017-18785Certain NETGEAR devices are affected by XSS.
- CVE-2020-11938In JetBrains TeamCity 2018.2 through 2019.2.1, a project administrator was able to see scrambled password parameters used in a project.
- CVE-2020-11796In JetBrains Space through 2020-04-22, the password authentication implementation was insecure.
- CVE-2020-11795In JetBrains Space through 2020-04-22, the session timeout period was configured improperly.
- CVE-2020-11693JetBrains YouTrack before 2020.1.659 was vulnerable to DoS that could be caused by attaching a malformed TIFF file to an issue.
- CVE-2020-11692In JetBrains YouTrack before 2020.1.659, DB export was accessible to read-only administrators.
- CVE-2020-11691In JetBrains Hub before 2020.1.12099, content spoofing in the Hub OAuth error message was possible.
- CVE-2020-11690In JetBrains IntelliJ IDEA before 2020.1, the license server could be resolved to an untrusted host in some cases.
- CVE-2020-11689In JetBrains TeamCity before 2019.2.1, a user without appropriate permissions was able to import settings from the settings.kts file.
- CVE-2020-11688In JetBrains TeamCity before 2019.2.1, the application state is kept alive after a user ends his session.
- CVE-2020-11687In JetBrains TeamCity before 2019.2.2, password values were shown in an unmasked format on several pages.
- CVE-2020-11686In JetBrains TeamCity before 2019.1.4, a project administrator was able to retrieve some TeamCity server settings.
- CVE-2020-11685In JetBrains GoLand before 2019.3.2, the plugin repository was accessed via HTTP instead of HTTPS.
- CVE-2020-11416JetBrains Space through 2020-04-22 allows stored XSS in Chats.
- CVE-2017-18788Certain NETGEAR devices are affected by command injection by an authenticated user.
- CVE-2017-18789Certain NETGEAR devices are affected by disclosure of sensitive information.
- CVE-2020-11539An issue was discovered on Tata Sonata Smart SF Rush 1.12 devices.
- CVE-2019-20102The attachment-uploading feature in Atlassian Confluence Server from version 6.14.0 through version 6.14.3, and version 6.15.0 before…Atlassian Confluence Server
- CVE-2020-12059An issue was discovered in Ceph through 13.2.9.