CVEs published April 1, 2020
107 CVEs were published on April 1, 2020: 1 critical, 5 high. 1 is now in CISA KEV.
- Published
- 107
- Critical
- 1
- High
- 5
- Medium
- 9
- Low
- 1
- Unrated
- 91
- Now in CISA KEV
- 1
- Fix available
- 53
Most affected products
- Apple macOS
- 18
- Apple iOS
- 8
- Apple iOS · Apple tvOS +3
- 5
- Apple iOS · Apple tvOS +4
- 5
- Apple iOS · Apple macOS +2
- 4
- Apple iOS · Apple macOS +4
- 3
- PHP Group PHP
- 3
- UniFi Video Controller
- 3
- Apache HTTP Server
- 2
- Apple iOS · Apple tvOS +1
- 2
Critical 1
High 5
- CVE-2020-11465An issue was discovered in Deskpro before 2019.8.0.
- CVE-2020-11466An issue was discovered in Deskpro before 2019.8.0.
- CVE-2020-10199Sonatype Nexus Repository before 3.21.2 allows JavaEL Injection (issue 1 of 2).org.sonatype.nexus:nexus-extdirect
- CVE-2020-7065mb_strtolower (UTF-32LE): stack-buffer-overflow at php_unicode_tolower_fullPHP Group PHP
- CVE-2020-6096An exploitable signed comparison vulnerability exists in the ARMv7 memcpy() implementation of GNU glibc 2.30.9000.GNU glibc
Medium, low and unrated 101
- CVE-2020-1927In Apache HTTP Server 2.4.0 to 2.4.41, redirects configured with mod_rewrite that were intended to be self-referential might be fooled by enApache HTTP Server
- CVE-2020-8146In UniFi Video v3.10.1 (for Windows 7/8/10 x64) there is a Local Privileges Escalation to SYSTEM from arbitrary file deletion and DLL hijackUniFi Video Controller
- CVE-2020-8145The UniFi Video Server (Windows) web interface configuration restore functionality at the “backup” and “wizard” endpoints does not implementUniFi Video Controller
- CVE-2020-8144The UniFi Video Server v3.9.3 and prior (for Windows 7/8/10 x64) web interface Firmware Update functionality, under certain circumstances, dUniFi Video Controller
- CVE-2020-11469Zoom Client for Meetings through 4.6.8 on macOS copies runwithroot to a user-writable temporary directory during installation, which allows
- CVE-2020-11470Zoom Client for Meetings through 4.6.8 on macOS has the disable-library-validation entitlement, which allows a local process (with the user'
- CVE-2020-1958When LDAP authentication is enabled in Apache Druid 0.17.0, callers of Druid APIs with a valid set of LDAP credentials can bypass the credenApache Druid · org.apache.druid:druid
- CVE-2019-17564Unsafe deserialization occurs within a Dubbo application which has HTTP remoting enabled.Apache Dubbo · org.apache.dubbo:dubbo-rpc-http-invoker
- CVE-2018-11802In Apache Solr, the cluster can be partitioned into multiple collections and only a subset of nodes actually host any given collection.Apache Solr · org.apache.solr:solr-parent +1
- CVE-2020-6009LearnDash Wordpress plugin version below 3.1.6 is vulnerable to Unauthenticated SQL Injection.LearnDash Wordpress Plugin
- CVE-2020-10598In BD Pyxis MedStation ES System v1.6.1 and Pyxis Anesthesia (PAS) ES System v1.6.1, a restricted desktop environment escape vulnerability eBecton, Dickinson and Company (BD) Pyxis MedStation ES Syst…
- CVE-2020-11463An issue was discovered in Deskpro before 2019.8.0.
- CVE-2020-11464An issue was discovered in Deskpro before 2019.8.0.
- CVE-2019-11254Kubernetes API Server denial of service vulnerability from malicious YAML payloadsKubernetes · gopkg.in/yaml.v2 +1
- CVE-2019-9163The connection initiation process in March Networks Command Client before 2.7.2 allows remote attackers to execute arbitrary code via crafte
- CVE-2020-8966Cross Site Scripting (XSS) flaws found in Tiki-Wiki CMS softwareTiki-Wiki Groupware Tiki-Wiki CMS
- CVE-2020-10948Jon Hedley AlienForm2 (typically installed as af.cgi or alienform.cgi) 2.0.2 is vulnerable to Remote Command Execution via eval injection, a
- CVE-2020-1954Apache CXF has the ability to integrate with JMX by registering an InstrumentationManager extension with the CXF bus.Apache CXF · org.apache.cxf:cxf-rt-management
- CVE-2020-5290session fixation in rCTFredpwn rctf
- CVE-2020-1934In Apache HTTP Server 2.4.0 to 2.4.41, mod_proxy_ftp may use uninitialized memory when proxying to a malicious FTP server.Apache HTTP Server
- CVE-2020-1949Scripts in Sling CMS before 0.16.0 do not property escape the Sling Selector from URLs when generating navigational elements for the adminisApache Sling
- CVE-2020-10204Sonatype Nexus Repository before 3.21.2 allows Remote Code Execution.org.sonatype.nexus:nexus-core
- CVE-2020-1943Data sent with contentId to /control/stream is not sanitized, allowing XSS attacks in Apache OFBiz 16.11.01 to 16.11.07.Apache OFBiz
- CVE-2020-3847An out-of-bounds read was addressed with improved input validation.Apple macOS
- CVE-2020-3849A memory corruption issue was addressed with improved input validation.Apple macOS
- CVE-2020-3848A memory corruption issue was addressed with improved input validation.Apple macOS
- CVE-2020-3850A memory corruption issue was addressed with improved input validation.Apple macOS
- CVE-2020-10203Sonatype Nexus Repository before 3.21.2 allows XSS.org.sonatype.nexus:nexus-core
- CVE-2020-9785Multiple memory corruption issues were addressed with improved state management.Apple iOS · Apple macOS +2
- CVE-2020-9783A use after free issue was addressed with improved memory management.Apple iOS · Apple tvOS +3
- CVE-2020-9780The issue was resolved by clearing application previews when content is deleted.Apple iOS
- CVE-2020-9784A logic issue was addressed with improved restrictions.Apple Safari
- CVE-2020-9781The issue was addressed by clearing website permission prompts after navigation.Apple iOS
- CVE-2020-9773The issue was addressed with improved handling of icon caches.Apple iOS
- CVE-2020-9770A logic issue was addressed with improved state management.Apple iOS
- CVE-2020-9777An issue existed in the selection of video file by Mail.Apple iOS
- CVE-2020-9775An issue existed in the handling of tabs displaying picture in picture video.Apple iOS
- CVE-2020-9776This issue was addressed with a new entitlement.Apple macOS
- CVE-2020-9768A use after free issue was addressed with improved memory management.Apple iOS · Apple tvOS +1
- CVE-2020-9769Multiple issues were addressed by updating to version 8.1.1850.Apple macOS
- CVE-2020-3919A memory initialization issue was addressed with improved memory handling.Apple iOS · Apple macOS +2
- CVE-2020-3910A buffer overflow was addressed with improved size validation.Apple iOS · Apple macOS +4
- CVE-2020-3917This issue was addressed with a new entitlement.Apple iOS · Apple tvOS +1
- CVE-2020-3914A memory initialization issue was addressed with improved memory handling.Apple iOS · Apple macOS +2
- CVE-2020-3911A buffer overflow was addressed with improved bounds checking.Apple iOS · Apple macOS +4
- CVE-2020-3916An access issue was addressed with additional sandbox restrictions.Apple iOS · Apple watchOS
- CVE-2020-3913A permissions issue existed.Apple iOS · Apple macOS +1
- CVE-2020-3912An out-of-bounds read was addressed with improved input validation.Apple macOS
- CVE-2020-3909A buffer overflow was addressed with improved bounds checking.Apple iOS · Apple macOS +4
- CVE-2020-3908An out-of-bounds read was addressed with improved input validation.Apple macOS
- CVE-2020-3905A memory corruption issue was addressed with improved input validation.Apple macOS
- CVE-2020-3907An out-of-bounds read was addressed with improved input validation.Apple macOS
- CVE-2020-3904Multiple memory corruption issues were addressed with improved state management.Apple macOS
- CVE-2020-3902An input validation issue was addressed with improved input validation.Apple iOS · Apple tvOS +3
- CVE-2020-3906A logic issue was addressed with improved restrictions.Apple macOS
- CVE-2020-3901A type confusion issue was addressed with improved memory handling.Apple iOS · Apple tvOS +4
- CVE-2020-3903A memory corruption issue was addressed with improved memory handling.Apple macOS
- CVE-2020-3900A memory corruption issue was addressed with improved memory handling.Apple iOS · Apple tvOS +4
- CVE-2020-3895A memory corruption issue was addressed with improved memory handling.Apple iOS · Apple tvOS +4
- CVE-2020-3899A memory consumption issue was addressed with improved memory handling.Apple iOS · Apple tvOS +4
- CVE-2020-3894A race condition was addressed with additional validation.Apple iOS · Apple tvOS +3
- CVE-2020-3897A type confusion issue was addressed with improved memory handling.Apple iOS · Apple tvOS +4
- CVE-2020-3892A memory corruption issue was addressed with improved input validation.Apple macOS
- CVE-2020-3893A memory corruption issue was addressed with improved input validation.Apple macOS
- CVE-2020-3891A logic issue was addressed with improved state management.Apple iOS · Apple watchOS
- CVE-2020-3885A logic issue was addressed with improved restrictions.Apple iOS · Apple tvOS +3
- CVE-2020-3887A logic issue was addressed with improved restrictions.Apple iOS · Apple tvOS +3
- CVE-2020-3890The issue was addressed with improved deletion.Apple iOS
- CVE-2020-3888A logic issue was addressed with improved restrictions.Apple iOS
- CVE-2020-3883This issue was addressed with improved checks.Apple iOS · Apple macOS +2
- CVE-2020-3889A logic issue was addressed with improved state management.Apple macOS
- CVE-2020-3884An injection issue was addressed with improved validation.Apple macOS
- CVE-2020-3881A logic issue was addressed with improved state management.Apple macOS
- CVE-2020-10868An issue was discovered in Avast Antivirus before 20.
- CVE-2020-10867An issue was discovered in Avast Antivirus before 20.
- CVE-2020-10866An issue was discovered in Avast Antivirus before 20.
- CVE-2020-10865An issue was discovered in Avast Antivirus before 20.
- CVE-2020-10864An issue was discovered in Avast Antivirus before 20.
- CVE-2020-10863An issue was discovered in Avast Antivirus before 20.
- CVE-2020-10862An issue was discovered in Avast Antivirus before 20.
- CVE-2020-10861An issue was discovered in Avast Antivirus before 20.
- CVE-2020-10860An issue was discovered in Avast Antivirus before 20.
- CVE-2018-11106NETGEAR has released fixes for a pre-authentication command injection in request_handler.php security vulnerability on the following productNETGEAR WC7500 · NETGEAR WC7520 +3
- CVE-2019-3944Parrot ANAFI is vulnerable to Wi-Fi deauthentication attack, allowing remote and unauthenticated attackers to disconnect drone from controllParrot ANAFI
- CVE-2019-3945Web server running on Parrot ANAFI can be crashed due to the SDK command "Common_CurrentDateTime" being sent to control service with larger Parrot ANAFI
- CVE-2019-3942Advantech WebAccess 8.3.4 does not properly restrict an RPC call that allows unauthenticated, remote users to read files.Advantech WebAccess
- CVE-2020-11455LimeSurvey before 4.1.12+200324 contains a path traversal vulnerability in application/controllers/admin/LimeSurveyFileManager.php.
- CVE-2020-11456LimeSurvey before 4.1.12+200324 has stored XSS in application/views/admin/surveysgroups/surveySettings.php and application/models/SurveysGro
- CVE-2020-11457pfSense before 2.4.5 has stored XSS in system_usermanager_addprivs.php in the WebGUI via the descr parameter (aka full name) of a user.
- CVE-2020-11449An issue was discovered on Technicolor TC7337 8.89.17 devices.
- CVE-2020-10231TP-Link NC200 through 2.1.8_Build_171109, NC210 through 1.0.9_Build_171214, NC220 through 1.3.0_Build_180105, NC230 through 1.3.0_Build_1712
- CVE-2020-7948An issue was discovered in the Login by Auth0 plugin before 4.0.0 for WordPress.
- CVE-2020-7947An issue was discovered in the Login by Auth0 plugin before 4.0.0 for WordPress.
- CVE-2020-5391Cross-site request forgery (CSRF) vulnerabilities exist in the Auth0 plugin before 4.0.0 for WordPress via the domain field.
- CVE-2020-6753The Login by Auth0 plugin before 4.0.0 for WordPress allows stored XSS on multiple pages, a different issue than CVE-2020-5392.
- CVE-2020-5392A stored cross-site scripting (XSS) vulnerability exists in the Auth0 plugin before 4.0.0 for WordPress via the settings page.
- CVE-2020-5548Yamaha LTE VoIP Router(NVR700W firmware Rev.15.00.15 and earlier), Yamaha Gigabit VoIP Router(NVR510 firmware Rev.15.01.14 and earlier), YamYamaha network devices
- CVE-2020-7263ENS configuration can be edited by attacker with local administrator permissionsMcAfee Endpoint Security (ENS) for Window
- CVE-2020-11445TP-Link cloud cameras through 2020-02-09 allow remote attackers to bypass authentication and obtain sensitive information via vectors involv
- CVE-2020-7066get_headers() silently truncates after a null bytePHP Group PHP
- CVE-2020-7064Use-of-uninitialized-value in exifPHP Group PHP