CVEs published April 2, 2020
56 CVEs were published on April 2, 2020: 0 critical, 6 high.
- Published
- 56
- Critical
- 0
- High
- 6
- Medium
- 16
- Low
- 3
- Unrated
- 31
- Now in CISA KEV
- 0
- Fix available
- 4
Most affected products
- ABB eSOMS
- 13
- IBM WebSphere Application Server Liberty
- 2
- SUSE Linux Enterprise Module for Desktop Applications 15… +2
- 2
- effect
- 1
- Fortinet FortiOS
- 1
- get-git-data
- 1
- git-add-remote
- 1
- IBM Process Federation Server · IBM Automation Workstream S…
- 1
- install-package
- 1
- install-package · umount
- 1
High 6
- CVE-2019-19094ABB eSOMS: SQL injection vulnerabilityABB eSOMS
- CVE-2019-19348An insecure modification vulnerability in the /etc/passwd file was found in the container openshift/apb-base, affecting versions before the Openshift Enterprise openshift/apb-base
- CVE-2019-19346An insecure modification vulnerability in the /etc/passwd file was found in the container openshift/mariadb-apb, affecting versions before tOpenshift Enterprise openshift/mariadb-apb
- CVE-2020-8835Linux kernel bpf verifier vulnerabilityLinux kernel
- CVE-2019-14868In ksh version 20120801, a flaw was found in the way it evaluates certain environment variables.KornShell ksh
- CVE-2020-8015Local privilege escalation in exim package from user mail to rootopenSUSE Factory
Medium, low and unrated 50
- CVE-2020-11499Firmware Analysis and Comparison Tool (FACT) 3 has Stored XSS when updating analysis details via a localhost web request, as demonstrated by
- CVE-2020-11498Slack Nebula through 1.1.0 contains a relative path vulnerability that allows a low-privileged attacker to execute code in the context of th
- CVE-2020-7630git-add-remote through 1.0.0 is vulnerable to Command Injection.git-add-remote
- CVE-2020-7629install-package through 0.4.0 is vulnerable to Command Injection.install-package
- CVE-2020-7628umount through 1.1.6 is vulnerable to Command Injection.install-package · umount
- CVE-2020-10515STARFACE UCC Client before 6.7.1.204 on WIndows allows binary planting to execute code with System rights, aka usd-2020-0006.
- CVE-2020-7627node-key-sender through 1.0.11 is vulnerable to Command Injection.node-key-sender
- CVE-2020-7626karma-mojo through 1.0.1 is vulnerable to Command Injection.karma-mojo
- CVE-2020-7625op-browser through 1.0.6 is vulnerable to Command Injection.op-browser
- CVE-2020-7624effect through 1.0.4 is vulnerable to Command Injection.effect
- CVE-2020-7623jscover through 1.0.0 is vulnerable to Command Injection.jscover
- CVE-2020-7621strong-nginx-controller through 1.0.2 is vulnerable to Command Injection.strong-nginx-controller
- CVE-2020-7619get-git-data through 1.3.1 is vulnerable to Command Injection.get-git-data
- CVE-2020-7620pomelo-monitor through 0.3.7 is vulnerable to Command Injection.It allows injection of arbitrary commands as part of 'pomelo-monitor' paramspomelo-monitor
- CVE-2020-9067There is a buffer overflow vulnerability in some Huawei products.SmartAX MA5600T · SmartAX MA5800 +1
- CVE-2020-11494An issue was discovered in slc_bump in drivers/net/can/slcan.c in the Linux kernel 3.16 through 5.6.2.
- CVE-2019-19002ABB eSOMS X-XSS-Protection not enabledABB eSOMS
- CVE-2019-19001eSOMS X-FrameOptionABB eSOMS
- CVE-2019-19000eSOMS Cachecontrol (Pragma) HTTP HeaderABB eSOMS
- CVE-2019-19097ABB eSOMS: SSL medium strength Cipher SuitesABB eSOMS
- CVE-2019-19096ABB eSOMS: REDIS clear text credentialsABB eSOMS
- CVE-2019-19095ABB eSOMS: Stored XSS vulnerabilityABB eSOMS
- CVE-2019-19093ABB eSOMS: Password complexity issueABB eSOMS
- CVE-2019-19092ABB eSOMS: Viewstate without MAC SignatureABB eSOMS
- CVE-2019-19091ABB eSOMS: HTTP response information leakageABB eSOMS
- CVE-2019-19090ABB eSOMS: Secure Flag not setABB eSOMS
- CVE-2019-19089eSOMS: X-Content-Type-Options Header MissingABB eSOMS
- CVE-2019-19003ABB eSOMS: HTTPOnly flag not setABB eSOMS
- CVE-2020-7617Prototype Pollutionrawiroaisen ini-parser · ini-parser
- CVE-2020-11107An issue was discovered in XAMPP before 7.2.29, 7.3.x before 7.3.16 , and 7.4.x before 7.4.4 on Windows.
- CVE-2020-11444Sonatype Nexus Repository Manager 3.x up to and including 3.21.2 has Incorrect Access Control.
- CVE-2020-8423A buffer overflow in the httpd daemon on TP-Link TL-WR841N V10 (firmware version 3.16.9) devices allows an authenticated remote attacker to
- CVE-2019-20635codeBeamer before 9.5.0-RC3 does not properly restrict the ability to execute custom Java code and access the Java class loader via computed
- CVE-2020-11453Microstrategy Web 10.4 is vulnerable to Server-Side Request Forgery in the Test Web Service functionality exposed through the path /MicroStr
- CVE-2020-11452Microstrategy Web 10.4 includes functionality to allow users to import files or data from external resources such as URLs or databases.
- CVE-2020-11450Microstrategy Web 10.4 exposes the JVM configuration, CPU architecture, installation folder, and other information through the URL /MicroStr
- CVE-2020-11451The Upload Visualization plugin in the Microstrategy Web 10.4 admin panel allows an administrator to upload a ZIP archive containing files w
- CVE-2020-11454Microstrategy Web 10.4 is vulnerable to Stored XSS in the HTML Container and Insert Text features in the window, allowing for the creation o
- CVE-2020-9349The CACAGOO Cloud Storage Intelligent Camera TV-288ZD-2MP with firmware 3.4.2.0919 allows access to the RTSP service without a password.
- CVE-2020-6852CACAGOO Cloud Storage Intelligent Camera TV-288ZD-2MP with firmware 3.4.2.0919 has weak authentication of TELNET access, leading to root pri
- CVE-2020-11100In hpack_dht_insert in hpack-tbl.c in the HPACK decoder in HAProxy 1.8 through 2.x before 2.1.4, a remote attacker can write arbitrary bytes
- CVE-2020-4325The IBM Process Federation Server 18.0.0.1, 18.0.0.2, 19.0.0.1, 19.0.0.2, and 19.0.0.3 Global Teams REST API does not properly shutdown the IBM Process Federation Server · IBM Automation Workstream S…
- CVE-2020-4304IBM WebSphere Application Server - Liberty 17.0.0.3 through 20.0.0.3 is vulnerable to cross-site scripting.IBM WebSphere Application Server Liberty
- CVE-2020-4303IBM WebSphere Application Server - Liberty 17.0.0.3 through 20.0.0.3 is vulnerable to cross-site scripting.IBM WebSphere Application Server Liberty
- CVE-2020-8017race condition on texlive-filesystem cron job allows for the deletion of unintended filesSUSE Linux Enterprise Module for Desktop Applications 15… +2
- CVE-2020-8016race condition in the packaging of texlive-filesystenSUSE Linux Enterprise Module for Desktop Applications 15… +2
- CVE-2018-13371An external control of system vulnerability in FortiOS may allow an authenticated, regular user to change the routing settings of the deviceFortinet FortiOS
- CVE-2020-11490Manage::Certificates in Zen Load Balancer 3.10.1 allows remote authenticated admins to execute arbitrary OS commands via shell metacharacter
- CVE-2020-11491Monitoring::Logs in Zen Load Balancer 3.10.1 allows remote authenticated admins to conduct absolute path traversal attacks, as demonstrated
- CVE-2020-11458app/Model/feed.php in MISP before 2.4.124 allows administrators to choose arbitrary files that should be ingested by MISP.