# CVEs published 2020-04-06

43 CVEs were published on April 6, 2020: 1 critical, 3 high. Days are UTC.

- [CVE-2020-11586](https://cve.now/CVE-2020-11586.md): An XXE issue was discovered in CIPPlanner CIPAce 9.1 Build 2019092801. (no CVSS)
- [CVE-2020-11587](https://cve.now/CVE-2020-11587.md): An issue was discovered in CIPPlanner CIPAce 9.1 Build 2019092801. (no CVSS)
- [CVE-2020-11588](https://cve.now/CVE-2020-11588.md): An issue was discovered in CIPPlanner CIPAce 9.1 Build 2019092801. (no CVSS)
- [CVE-2020-11589](https://cve.now/CVE-2020-11589.md): An Insecure Direct Object Reference issue was discovered in CIPPlanner CIPAce 9.1 Build 2019092801. (no CVSS)
- [CVE-2020-11590](https://cve.now/CVE-2020-11590.md): An issue was discovered in CIPPlanner CIPAce 9.1 Build 2019092801. (no CVSS)
- [CVE-2020-11591](https://cve.now/CVE-2020-11591.md): An issue was discovered in CIPPlanner CIPAce 9.1 Build 2019092801. (no CVSS)
- [CVE-2020-11592](https://cve.now/CVE-2020-11592.md): An issue was discovered in CIPPlanner CIPAce 9.1 Build 2019092801. (no CVSS)
- [CVE-2020-11593](https://cve.now/CVE-2020-11593.md): An issue was discovered in CIPPlanner CIPAce 9.1 Build 2019092801. (no CVSS)
- [CVE-2020-11594](https://cve.now/CVE-2020-11594.md): An issue was discovered in CIPPlanner CIPAce 9.1 Build 2019092801. (no CVSS)
- [CVE-2020-11595](https://cve.now/CVE-2020-11595.md): An issue was discovered in CIPPlanner CIPAce 9.1 Build 2019092801. (no CVSS)
- [CVE-2020-11596](https://cve.now/CVE-2020-11596.md): A Directory Traversal issue was discovered in CIPPlanner CIPAce 9.1 Build 2019092801. (no CVSS)
- [CVE-2020-11597](https://cve.now/CVE-2020-11597.md): An issue was discovered in CIPPlanner CIPAce 9.1 Build 2019092801. (no CVSS)
- [CVE-2020-11598](https://cve.now/CVE-2020-11598.md): An issue was discovered in CIPPlanner CIPAce 9.1 Build 2019092801. (no CVSS)
- [CVE-2020-11599](https://cve.now/CVE-2020-11599.md): An issue was discovered in CIPPlanner CIPAce 6.80 Build 2016031401. (no CVSS)
- [CVE-2020-11585](https://cve.now/CVE-2020-11585.md): There is an information disclosure issue in DNN (formerly DotNetNuke) 9.5 within the built-in Activity-Feed/Messaging/Userid/ Message Center (no CVSS)
- [CVE-2020-11581](https://cve.now/CVE-2020-11581.md): An issue was discovered in Pulse Secure Pulse Connect Secure (PCS) through 2020-04-06. (no CVSS)
- [CVE-2020-11582](https://cve.now/CVE-2020-11582.md): An issue was discovered in Pulse Secure Pulse Connect Secure (PCS) through 2020-04-06. (no CVSS)
- [CVE-2020-11580](https://cve.now/CVE-2020-11580.md): An issue was discovered in Pulse Secure Pulse Connect Secure (PCS) through 2020-04-06. (no CVSS)
- [CVE-2020-5832](https://cve.now/CVE-2020-5832.md): Symantec Data Center Security Manager Component, prior to 6.8.2 (aka 6.8 MP2), may be susceptible to a privilege escalation vulnerability, w (no CVSS, Data Center Security Manager Component)
- [CVE-2020-5300](https://cve.now/CVE-2020-5300.md): Disallow replay of \`private\_key\_jwt\` by blacklisting JTIs in Hydra (CVSS 5.8, ory hydra · github.com/ory/hydra)
- [CVE-2020-11102](https://cve.now/CVE-2020-11102.md): hw/net/tulip.c in QEMU 4.2.0 has a buffer overflow during the copying of tx/rx buffers because the frame size is not validated against the r (no CVSS)
- [CVE-2020-11507](https://cve.now/CVE-2020-11507.md): An Untrusted Search Path vulnerability in Malwarebytes AdwCleaner 8.0.3 could cause arbitrary code execution with SYSTEM privileges when a m (no CVSS)
- [CVE-2019-19699](https://cve.now/CVE-2019-19699.md): There is Authenticated remote code execution in Centreon Infrastructure Monitoring Software through 19.10 via Pollers misconfiguration, lead (no CVSS)
- [CVE-2020-11544](https://cve.now/CVE-2020-11544.md): An issue was discovered in Project Worlds Official Car Rental System 1. (no CVSS)
- [CVE-2020-11545](https://cve.now/CVE-2020-11545.md): Project Worlds Official Car Rental System 1 is vulnerable to multiple SQL injection issues, as demonstrated by the email and parameters (acc (no CVSS)
- [CVE-2020-9473](https://cve.now/CVE-2020-9473.md): The S. (no CVSS)
- [CVE-2020-7622](https://cve.now/CVE-2020-7622.md): HTTP Response Splitting (CVSS 6.5, io.jooby:jooby-netty)
- [CVE-2020-1728](https://cve.now/CVE-2020-1728.md): A vulnerability was found in all versions of Keycloak where, the pages on the Admin Console area of the application are completely missing g (CVSS 4.8, \[UNKNOWN\] keycloak · org.keycloak:keycloak-core)
- [CVE-2020-7639](https://cve.now/CVE-2020-7639.md): eivindfjeldstad-dot below 1.0.3 is vulnerable to Prototype Pollution.The function 'set' could be tricked into adding or modifying properties (no CVSS, @eivifj/dot)
- [CVE-2020-8004](https://cve.now/CVE-2020-8004.md): STMicroelectronics STM32F1 devices have Incorrect Access Control. (no CVSS)
- [CVE-2020-7638](https://cve.now/CVE-2020-7638.md): confinit through 0.3.0 is vulnerable to Prototype Pollution.The 'setDeepProperty' function could be tricked into adding or modifying propert (no CVSS, confinit)
- [CVE-2020-7637](https://cve.now/CVE-2020-7637.md): class-transformer before 0.3.1 allow attackers to perform Prototype Pollution. (no CVSS, class-transformer)
- [CVE-2020-7636](https://cve.now/CVE-2020-7636.md): adb-driver through 0.1.8 is vulnerable to Command Injection.It allows execution of arbitrary commands via the command function. (no CVSS, adb-driver)
- [CVE-2020-7635](https://cve.now/CVE-2020-7635.md): compass-compile through 0.0.1 is vulnerable to Command Injection.It allows execution of arbitrary commands via tha options argument. (no CVSS, compass-compile)
- [CVE-2020-7634](https://cve.now/CVE-2020-7634.md): heroku-addonpool through 0.1.15 is vulnerable to Command Injection. (no CVSS, heroku-addonpool)
- [CVE-2020-7633](https://cve.now/CVE-2020-7633.md): apiconnect-cli-plugins through 6.0.1 is vulnerable to Command Injection.It allows execution of arbitrary commands via the pluginUri argument (no CVSS, apiconnect-cli-plugins)
- [CVE-2020-7632](https://cve.now/CVE-2020-7632.md): node-mpv through 1.4.3 is vulnerable to Command Injection. (no CVSS, node-mpv)
- [CVE-2020-7631](https://cve.now/CVE-2020-7631.md): diskusage-ng through 0.2.4 is vulnerable to Command Injection.It allows execution of arbitrary commands via the path argument. (no CVSS, diskusage-ng)
- [CVE-2020-10267](https://cve.now/CVE-2020-10267.md): RVD#1489: Unprotected intelectual property in Universal Robots controller CB 3.1 across firmware versions (CVSS 7.5, Universal Robots UR3, UR5 and UR10)
- [CVE-2020-10266](https://cve.now/CVE-2020-10266.md): RVD#1487: No integrity checks on UR+ platform artifacts when installed in the robot (CVSS 8.8, Universal Robots URx)
- [CVE-2020-10265](https://cve.now/CVE-2020-10265.md): RVD#1443: UR dashboard server enables unauthenticated remote control of core robot functions (CVSS 9.4, Universal Robots Robot Controllers CB 2, CB3, e-series)
- [CVE-2020-10264](https://cve.now/CVE-2020-10264.md): RTDE Interface allows unauthenticated reading of robot data and unauthenticated writing of registers and outputs (CVSS 8.8, Universal Robots A/S Universal Robots Robot Controllers CB…)
- [CVE-2020-11565](https://cve.now/CVE-2020-11565.md): An issue was discovered in the Linux kernel through 5.6.2. (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2020-04-06
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.