# CVEs published 2020-04-03 25 CVEs were published on April 3, 2020: 1 critical, 1 high. Days are UTC. - [CVE-2020-5348](https://cve.now/CVE-2020-5348.md): Dell Latitude 7202 Rugged Tablet BIOS versions prior to A28 contain a UAF vulnerability in EFI\_BOOT\_SERVICES in system management mode. (CVSS 6.8, Dell CPG BIOS) - [CVE-2020-5347](https://cve.now/CVE-2020-5347.md): Dell EMC Isilon OneFS versions 8.2.2 and earlier contain a denial of service vulnerability. (CVSS 5.3, Dell Isilon OneFS) - [CVE-2020-8143](https://cve.now/CVE-2020-8143.md): An Open Redirect vulnerability was discovered in Revive Adserver version \< 5.0.5 and reported by HackerOne user hoangn144. (no CVSS, https://github.com/revive-adserver/revive-adserver) - [CVE-2020-8147](https://cve.now/CVE-2020-8147.md): Flaw in input validation in npm package utils-extend version 1.0.8 and earlier may allow prototype pollution attack that may result in remot (no CVSS, utils-extend) - [CVE-2020-8142](https://cve.now/CVE-2020-8142.md): A security restriction bypass vulnerability has been discovered in Revive Adserver version \< 5.0.5 by HackerOne user hoangn144. (no CVSS, https://github.com/revive-adserver/revive-adserver) - [CVE-2020-8639](https://cve.now/CVE-2020-8639.md): An unrestricted file upload vulnerability in keywordsImport.php in TestLink 1.9.20 allows remote attackers to execute arbitrary code by uplo (no CVSS) - [CVE-2020-8638](https://cve.now/CVE-2020-8638.md): A SQL injection vulnerability in TestLink 1.9.20 allows attackers to execute arbitrary SQL commands in planUrgency.php via the urgency param (no CVSS) - [CVE-2020-8637](https://cve.now/CVE-2020-8637.md): A SQL injection vulnerability in TestLink 1.9.20 allows attackers to execute arbitrary SQL commands in dragdroptreenodes.php via the node\_id (no CVSS) - [CVE-2020-6994](https://cve.now/CVE-2020-6994.md): A buffer overflow vulnerability was found in some devices of Hirschmann Automation and Control HiOS and HiSecOS. (no CVSS, Hirschmann Automation and Control GmbH, a division of Belde…) - [CVE-2020-10599](https://cve.now/CVE-2020-10599.md): VISAM VBASE Editor version 11.5.0.2 and VBASE Web-Remote Module may allow a vulnerable ActiveX component to be exploited resulting in a buff (no CVSS, VISAM VBASE Editor · VISAM VBASE Web-Remote Module) - [CVE-2020-7000](https://cve.now/CVE-2020-7000.md): VISAM VBASE Editor version 11.5.0.2 and VBASE Web-Remote Module may allow an unauthenticated attacker to discover the cryptographic key from (no CVSS, VISAM VBASE Editor · VISAM VBASE Web-Remote Module) - [CVE-2020-10601](https://cve.now/CVE-2020-10601.md): VISAM VBASE Editor version 11.5.0.2 and VBASE Web-Remote Module allow weak hashing algorithm and insecure permissions which may allow a loca (no CVSS, VISAM VBASE Editor · VISAM VBASE Web-Remote Module) - [CVE-2020-7004](https://cve.now/CVE-2020-7004.md): VISAM VBASE Editor version 11.5.0.2 and VBASE Web-Remote Module may allow weak or insecure permissions on the VBASE directory resulting in e (no CVSS, VISAM VBASE Editor · VISAM VBASE Web-Remote Module) - [CVE-2020-7008](https://cve.now/CVE-2020-7008.md): VISAM VBASE Editor version 11.5.0.2 and VBASE Web-Remote Module may allow input passed in the URL that is not properly verified before use, (no CVSS, VISAM VBASE Editor · VISAM VBASE Web-Remote Module) - [CVE-2020-10689](https://cve.now/CVE-2020-10689.md): A flaw was found in the Eclipse Che up to version 7.8.x, where it did not properly restrict access to workspace pods. (CVSS 6.4, Red Hat Eclipse Che) - [CVE-2019-17230](https://cve.now/CVE-2019-17230.md): includes/theme-functions.php in the OneTone theme through 3.0.6 for WordPress allows unauthenticated options changes. (no CVSS) - [CVE-2019-17231](https://cve.now/CVE-2019-17231.md): includes/theme-functions.php in the OneTone theme through 3.0.6 for WordPress has multiple stored XSS issues. (no CVSS) - [CVE-2020-10960](https://cve.now/CVE-2020-10960.md): In MediaWiki before 1.34.1, users can add various Cascading Style Sheets (CSS) classes (which can affect what content is shown or hidden in (no CVSS, mediawiki/core) - [CVE-2020-11501](https://cve.now/CVE-2020-11501.md): GnuTLS 3.6.x before 3.6.13 uses incorrect cryptography for DTLS. (no CVSS) - [CVE-2020-4273](https://cve.now/CVE-2020-4273.md): IBM Spectrum Scale 4.2 and 5.0 could allow a local unprivileged attacker with intimate knowledge of the enviornment to execute commands as r (CVSS 7.4, IBM Spectrum Scale) - [CVE-2020-11500](https://cve.now/CVE-2020-11500.md): Zoom Client for Meetings through 4.6.9 uses the ECB mode of AES for video and audio encryption. (no CVSS) - [CVE-2019-18905](https://cve.now/CVE-2019-18905.md): Deprecated functionality in autoyast2 automatically imports gpg keys without checking them (CVSS 4.8, SUSE Linux Enterprise Server) - [CVE-2019-18904](https://cve.now/CVE-2019-18904.md): Migrations requests can cause DoS on rmt (CVSS 6.5, SUSE Linux Enterprise High Performance Computing 15-ESPO… +5) - [CVE-2018-17954](https://cve.now/CVE-2018-17954.md): crowbar provision leaks admin password to all nodes in cleartext (CVSS 9.3, SUSE OpenStack Cloud) - [CVE-2020-5283](https://cve.now/CVE-2020-5283.md): XSS vulnerability in CVS show\_subdir\_lastmod support (CVSS 3.1, viewvc) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2020-04-03 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.