# CVEs published 2020-04-02

56 CVEs were published on April 2, 2020: 0 critical, 6 high. Days are UTC.

- [CVE-2020-11499](https://cve.now/CVE-2020-11499.md): Firmware Analysis and Comparison Tool (FACT) 3 has Stored XSS when updating analysis details via a localhost web request, as demonstrated by (CVSS 3.3)
- [CVE-2020-11498](https://cve.now/CVE-2020-11498.md): Slack Nebula through 1.1.0 contains a relative path vulnerability that allows a low-privileged attacker to execute code in the context of th (no CVSS)
- [CVE-2020-7630](https://cve.now/CVE-2020-7630.md): git-add-remote through 1.0.0 is vulnerable to Command Injection. (no CVSS, git-add-remote)
- [CVE-2020-7629](https://cve.now/CVE-2020-7629.md): install-package through 0.4.0 is vulnerable to Command Injection. (no CVSS, install-package)
- [CVE-2020-7628](https://cve.now/CVE-2020-7628.md): umount through 1.1.6 is vulnerable to Command Injection. (no CVSS, install-package · umount)
- [CVE-2020-10515](https://cve.now/CVE-2020-10515.md): STARFACE UCC Client before 6.7.1.204 on WIndows allows binary planting to execute code with System rights, aka usd-2020-0006. (no CVSS)
- [CVE-2020-7627](https://cve.now/CVE-2020-7627.md): node-key-sender through 1.0.11 is vulnerable to Command Injection. (no CVSS, node-key-sender)
- [CVE-2020-7626](https://cve.now/CVE-2020-7626.md): karma-mojo through 1.0.1 is vulnerable to Command Injection. (no CVSS, karma-mojo)
- [CVE-2020-7625](https://cve.now/CVE-2020-7625.md): op-browser through 1.0.6 is vulnerable to Command Injection. (no CVSS, op-browser)
- [CVE-2020-7624](https://cve.now/CVE-2020-7624.md): effect through 1.0.4 is vulnerable to Command Injection. (no CVSS, effect)
- [CVE-2020-7623](https://cve.now/CVE-2020-7623.md): jscover through 1.0.0 is vulnerable to Command Injection. (no CVSS, jscover)
- [CVE-2020-7621](https://cve.now/CVE-2020-7621.md): strong-nginx-controller through 1.0.2 is vulnerable to Command Injection. (no CVSS, strong-nginx-controller)
- [CVE-2020-7619](https://cve.now/CVE-2020-7619.md): get-git-data through 1.3.1 is vulnerable to Command Injection. (no CVSS, get-git-data)
- [CVE-2020-7620](https://cve.now/CVE-2020-7620.md): pomelo-monitor through 0.3.7 is vulnerable to Command Injection.It allows injection of arbitrary commands as part of 'pomelo-monitor' params (no CVSS, pomelo-monitor)
- [CVE-2020-9067](https://cve.now/CVE-2020-9067.md): There is a buffer overflow vulnerability in some Huawei products. (no CVSS, SmartAX MA5600T · SmartAX MA5800 +1)
- [CVE-2020-11494](https://cve.now/CVE-2020-11494.md): An issue was discovered in slc\_bump in drivers/net/can/slcan.c in the Linux kernel 3.16 through 5.6.2. (no CVSS)
- [CVE-2019-19002](https://cve.now/CVE-2019-19002.md): ABB eSOMS X-XSS-Protection not enabled (CVSS 6.3, ABB eSOMS)
- [CVE-2019-19001](https://cve.now/CVE-2019-19001.md): eSOMS X-FrameOption (CVSS 6.5, ABB eSOMS)
- [CVE-2019-19000](https://cve.now/CVE-2019-19000.md): eSOMS Cachecontrol (Pragma) HTTP Header (CVSS 6.5, ABB eSOMS)
- [CVE-2019-19097](https://cve.now/CVE-2019-19097.md): ABB eSOMS: SSL medium strength Cipher Suites (CVSS 5.9, ABB eSOMS)
- [CVE-2019-19096](https://cve.now/CVE-2019-19096.md): ABB eSOMS: REDIS clear text credentials (CVSS 6.1, ABB eSOMS)
- [CVE-2019-19095](https://cve.now/CVE-2019-19095.md): ABB eSOMS: Stored XSS vulnerability (CVSS 5.4, ABB eSOMS)
- [CVE-2019-19094](https://cve.now/CVE-2019-19094.md): ABB eSOMS: SQL injection vulnerability (CVSS 7.6, ABB eSOMS)
- [CVE-2019-19093](https://cve.now/CVE-2019-19093.md): ABB eSOMS: Password complexity issue (CVSS 6.5, ABB eSOMS)
- [CVE-2019-19092](https://cve.now/CVE-2019-19092.md): ABB eSOMS: Viewstate without MAC Signature (CVSS 3.5, ABB eSOMS)
- [CVE-2019-19091](https://cve.now/CVE-2019-19091.md): ABB eSOMS: HTTP response information leakage (CVSS 4.3, ABB eSOMS)
- [CVE-2019-19090](https://cve.now/CVE-2019-19090.md): ABB eSOMS: Secure Flag not set (CVSS 3.5, ABB eSOMS)
- [CVE-2019-19089](https://cve.now/CVE-2019-19089.md): eSOMS: X-Content-Type-Options Header Missing (CVSS 6.1, ABB eSOMS)
- [CVE-2019-19003](https://cve.now/CVE-2019-19003.md): ABB eSOMS: HTTPOnly flag not set (CVSS 5.3, ABB eSOMS)
- [CVE-2019-19348](https://cve.now/CVE-2019-19348.md): An insecure modification vulnerability in the /etc/passwd file was found in the container openshift/apb-base, affecting versions before the (CVSS 7.0, Openshift Enterprise openshift/apb-base)
- [CVE-2019-19346](https://cve.now/CVE-2019-19346.md): An insecure modification vulnerability in the /etc/passwd file was found in the container openshift/mariadb-apb, affecting versions before t (CVSS 7.0, Openshift Enterprise openshift/mariadb-apb)
- [CVE-2020-8835](https://cve.now/CVE-2020-8835.md): Linux kernel bpf verifier vulnerability (CVSS 7.8, Linux kernel)
- [CVE-2020-7617](https://cve.now/CVE-2020-7617.md): Prototype Pollution (CVSS 4.4, rawiroaisen ini-parser · ini-parser)
- [CVE-2020-11107](https://cve.now/CVE-2020-11107.md): An issue was discovered in XAMPP before 7.2.29, 7.3.x before 7.3.16 , and 7.4.x before 7.4.4 on Windows. (no CVSS)
- [CVE-2020-11444](https://cve.now/CVE-2020-11444.md): Sonatype Nexus Repository Manager 3.x up to and including 3.21.2 has Incorrect Access Control. (no CVSS)
- [CVE-2020-8423](https://cve.now/CVE-2020-8423.md): A buffer overflow in the httpd daemon on TP-Link TL-WR841N V10 (firmware version 3.16.9) devices allows an authenticated remote attacker to (no CVSS)
- [CVE-2019-14868](https://cve.now/CVE-2019-14868.md): In ksh version 20120801, a flaw was found in the way it evaluates certain environment variables. (CVSS 7.4, KornShell ksh)
- [CVE-2019-20635](https://cve.now/CVE-2019-20635.md): codeBeamer before 9.5.0-RC3 does not properly restrict the ability to execute custom Java code and access the Java class loader via computed (no CVSS)
- [CVE-2020-11453](https://cve.now/CVE-2020-11453.md): Microstrategy Web 10.4 is vulnerable to Server-Side Request Forgery in the Test Web Service functionality exposed through the path /MicroStr (no CVSS)
- [CVE-2020-11452](https://cve.now/CVE-2020-11452.md): Microstrategy Web 10.4 includes functionality to allow users to import files or data from external resources such as URLs or databases. (no CVSS)
- [CVE-2020-11450](https://cve.now/CVE-2020-11450.md): Microstrategy Web 10.4 exposes the JVM configuration, CPU architecture, installation folder, and other information through the URL /MicroStr (no CVSS)
- [CVE-2020-11451](https://cve.now/CVE-2020-11451.md): The Upload Visualization plugin in the Microstrategy Web 10.4 admin panel allows an administrator to upload a ZIP archive containing files w (no CVSS)
- [CVE-2020-11454](https://cve.now/CVE-2020-11454.md): Microstrategy Web 10.4 is vulnerable to Stored XSS in the HTML Container and Insert Text features in the window, allowing for the creation o (no CVSS)
- [CVE-2020-9349](https://cve.now/CVE-2020-9349.md): The CACAGOO Cloud Storage Intelligent Camera TV-288ZD-2MP with firmware 3.4.2.0919 allows access to the RTSP service without a password. (no CVSS)
- [CVE-2020-6852](https://cve.now/CVE-2020-6852.md): CACAGOO Cloud Storage Intelligent Camera TV-288ZD-2MP with firmware 3.4.2.0919 has weak authentication of TELNET access, leading to root pri (no CVSS)
- [CVE-2020-11100](https://cve.now/CVE-2020-11100.md): In hpack\_dht\_insert in hpack-tbl.c in the HPACK decoder in HAProxy 1.8 through 2.x before 2.1.4, a remote attacker can write arbitrary bytes (no CVSS)
- [CVE-2020-4325](https://cve.now/CVE-2020-4325.md): The IBM Process Federation Server 18.0.0.1, 18.0.0.2, 19.0.0.1, 19.0.0.2, and 19.0.0.3 Global Teams REST API does not properly shutdown the (CVSS 6.5, IBM Process Federation Server · IBM Automation Workstream S…)
- [CVE-2020-4304](https://cve.now/CVE-2020-4304.md): IBM WebSphere Application Server - Liberty 17.0.0.3 through 20.0.0.3 is vulnerable to cross-site scripting. (CVSS 6.1, IBM WebSphere Application Server Liberty)
- [CVE-2020-4303](https://cve.now/CVE-2020-4303.md): IBM WebSphere Application Server - Liberty 17.0.0.3 through 20.0.0.3 is vulnerable to cross-site scripting. (CVSS 6.1, IBM WebSphere Application Server Liberty)
- [CVE-2020-8017](https://cve.now/CVE-2020-8017.md): race condition on texlive-filesystem cron job allows for the deletion of unintended files (CVSS 6.2, SUSE Linux Enterprise Module for Desktop Applications 15… +2)
- [CVE-2020-8016](https://cve.now/CVE-2020-8016.md): race condition in the packaging of texlive-filesysten (CVSS 4.9, SUSE Linux Enterprise Module for Desktop Applications 15… +2)
- [CVE-2018-13371](https://cve.now/CVE-2018-13371.md): An external control of system vulnerability in FortiOS may allow an authenticated, regular user to change the routing settings of the device (no CVSS, Fortinet FortiOS)
- [CVE-2020-11490](https://cve.now/CVE-2020-11490.md): Manage::Certificates in Zen Load Balancer 3.10.1 allows remote authenticated admins to execute arbitrary OS commands via shell metacharacter (no CVSS)
- [CVE-2020-11491](https://cve.now/CVE-2020-11491.md): Monitoring::Logs in Zen Load Balancer 3.10.1 allows remote authenticated admins to conduct absolute path traversal attacks, as demonstrated (no CVSS)
- [CVE-2020-11458](https://cve.now/CVE-2020-11458.md): app/Model/feed.php in MISP before 2.4.124 allows administrators to choose arbitrary files that should be ingested by MISP. (no CVSS)
- [CVE-2020-8015](https://cve.now/CVE-2020-8015.md): Local privilege escalation in exim package from user mail to root (CVSS 8.4, openSUSE Factory)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2020-04-02
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.