CVEs published April 7, 2020
126 CVEs were published on April 7, 2020: 0 critical, 1 high.
- Published
- 126
- Critical
- 0
- High
- 1
- Medium
- 1
- Low
- 0
- Unrated
- 124
- Now in CISA KEV
- 0
- Fix available
- 11
Most affected products
- xdlocalstorage
- 4
- com.fasterxml.jackson.core:jackson-databind
- 2
- GE Mark VIe Controller
- 2
- HCL AppScan Standard Edition
- 2
- Bitdefender High-Level Antimalware SDK for Windows
- 1
- clamscan
- 1
- examknow MH-WikiBot
- 1
- express-mock-middleware
- 1
- FortiADC
- 1
- Fortinet FortiADC
- 1
High 1
Medium, low and unrated 125
- CVE-2020-10366LogicalDoc before 8.3.3 allows /servlet.gupld Directory Traversal, a different vulnerability than CVE-2020-9423 and CVE-2020-10365.
- CVE-2020-11626An issue was discovered in EJBCA before 6.15.2.6 and 7.x before 7.3.1.2.
- CVE-2020-11627An issue was discovered in EJBCA before 6.15.2.6 and 7.x before 7.3.1.2.
- CVE-2020-11628An issue was discovered in EJBCA before 6.15.2.6 and 7.x before 7.3.1.2.
- CVE-2020-11629An issue was discovered in EJBCA before 6.15.2.6 and 7.x before 7.3.1.2.
- CVE-2020-11630An issue was discovered in EJBCA before 6.15.2.6 and 7.x before 7.3.1.2.
- CVE-2020-11631An issue was discovered in EJBCA before 6.15.2.6 and 7.x before 7.3.1.2.
- CVE-2020-11543OpsRamp Gateway before 7.0.0 has a backdoor account vadmin with the password 9vt@f3Vt that allows root SSH access to the server.
- CVE-2020-11620FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.cocom.fasterxml.jackson.core:jackson-databind
- CVE-2020-11619FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.springfracom.fasterxml.jackson.core:jackson-databind
- CVE-2020-9286An improper authorization vulnerability in FortiADC may allow a remote authenticated user with low privileges to perform certain actions sucFortiADC
- CVE-2020-11509An XSS vulnerability in the WP Lead Plus X plugin through 0.98 for WordPress allows remote attackers to upload page templates containing arb
- CVE-2020-11508An XSS vulnerability in the WP Lead Plus X plugin through 0.98 for WordPress allows logged-in users with minimal permissions to create or re
- CVE-2020-6647An improper neutralization of input vulnerability in the dashboard of FortiADC may allow an authenticated attacker to perform a cross site sFortinet FortiADC
- CVE-2020-11612The ZlibDecoders in Netty 4.1.x before 4.1.46 allow for unbounded memory allocation while decoding a ZlibEncoded byte stream.io.netty:netty-handler
- CVE-2013-7488perl-Convert-ASN1 (aka the Convert::ASN1 module for Perl) through 0.27 allows remote attackers to cause an infinite loop via unexpected inpu
- CVE-2015-9544An issue was discovered in xdLocalStorage through 2.0.5.xdlocalstorage
- CVE-2020-11610An issue was discovered in xdLocalStorage through 2.0.5.xdlocalstorage
- CVE-2020-11611An issue was discovered in xdLocalStorage through 2.0.5.xdlocalstorage
- CVE-2015-9545An issue was discovered in xdLocalStorage through 2.0.5.xdlocalstorage
- CVE-2019-17657An Uncontrolled Resource Consumption vulnerability in Fortinet FortiSwitch below 3.6.11, 6.0.6 and 6.2.2, FortiAnalyzer below 6.2.3, FortiMaFortinet FortiSwitch · FortiAnalyzer +2
- CVE-2020-6974Honeywell Notifier Web Server (NWS) Version 3.50 is vulnerable to a path traversal attack, which allows an attacker to bypass access to restHoneywell Notifier Web Server
- CVE-2019-13559GE Mark VIe Controller is shipped with pre-configured hard-coded credentials that may allow root-user access to the controller.GE Mark VIe Controller
- CVE-2019-13554GE Mark VIe Controller has an unsecured Telnet protocol that may allow a user to create an authenticated session using generic default credeGE Mark VIe Controller
- CVE-2020-11516Stored XSS in the Contact Form 7 Datepicker plugin through 2.6.0 for WordPress allows authenticated attackers with minimal permissions to sa
- CVE-2020-11515The Rank Math plugin through 1.0.40.2 for WordPress allows unauthenticated remote attackers to create new URIs (that redirect to an external
- CVE-2020-11514The Rank Math plugin through 1.0.40.2 for WordPress allows unauthenticated remote attackers to update arbitrary WordPress metadata, includin
- CVE-2020-9514An issue was discovered in the IMPress for IDX Broker plugin before 2.6.2 for WordPress.
- CVE-2020-11512Stored XSS in the IMPress for IDX Broker WordPress plugin before 2.6.2 allows authenticated attackers with minimal (subscriber-level) permis
- CVE-2020-11609An issue was discovered in the stv06xx subsystem in the Linux kernel before 5.6.1.
- CVE-2017-18647An issue was discovered on Samsung mobile devices with M(6,x) and N(7.0) software.
- CVE-2017-18648An issue was discovered on Samsung mobile devices with KK(4.4.x), L(5.x), M(6.x), and N(7.x) software.
- CVE-2017-18649An issue was discovered on Samsung mobile devices with N(7.x) software.
- CVE-2017-18650An issue was discovered on Samsung mobile devices with N(7.x) software.
- CVE-2017-18651An issue was discovered on Samsung mobile devices with M(6.x) and N(7.x) software.
- CVE-2017-18652An issue was discovered on Samsung mobile devices with M(6.0) and N(7.x) software.
- CVE-2017-18653An issue was discovered on Samsung mobile devices with KK(4.4), L(5.0/5.1), M(6.0), and N(7.x) software.
- CVE-2017-18654An issue was discovered on Samsung mobile devices with M(6.0) and N(7.0, 7.1) software.
- CVE-2017-18655An issue was discovered on Samsung mobile devices with M(6.0) and N(7.x) software.
- CVE-2017-18656An issue was discovered on Samsung mobile devices with M(6.0) and N(7.x) software.
- CVE-2017-18657An issue was discovered on Samsung mobile devices with M(6.0) and N(7.x) software.
- CVE-2017-18658An issue was discovered on Samsung mobile devices with M(6.0) software.
- CVE-2017-18659An issue was discovered on Samsung mobile devices with KK(4.4), L(5.0/5.1), M(6.0), and N(7.x) software.
- CVE-2017-18660An issue was discovered on Samsung mobile devices with M(6.0) and N(7.x) software.
- CVE-2017-18661An issue was discovered on Samsung mobile devices with M(6.0) and N(7.x) software.
- CVE-2017-18662An issue was discovered on Samsung mobile devices with M(6.0) and N(7.x) software.
- CVE-2017-18663An issue was discovered on Samsung mobile devices with N(7.x) software.
- CVE-2017-18664An issue was discovered on Samsung mobile devices with KK(4.4), L(5.0/5.1), and M(6.0) software.
- CVE-2017-18665An issue was discovered on Samsung mobile devices with M(6.0) software.
- CVE-2019-4393HCL AppScan Standard is vulnerable to excessive authorization attemptsHCL AppScan Standard Edition
- CVE-2019-4391HCL AppScan Standard is vulnerable to XML External Entity Injection (XXE) attack when processing XML dataHCL AppScan Standard Edition
- CVE-2017-18666An issue was discovered on Samsung mobile devices with KK(4.4), L(5.0/5.1), M(6.0), and N(7.x) software.
- CVE-2017-18667An issue was discovered on Samsung mobile devices with KK(4.4), L(5.0/5.1), M(6.0), and N(7.x) software.
- CVE-2017-18668An issue was discovered on Samsung mobile devices with M(6.0) software.
- CVE-2017-18669An issue was discovered on Samsung mobile devices with N(7.x) software.
- CVE-2017-18670An issue was discovered on Samsung mobile devices with KK(4.4), L(5.0/5.1), and M(6.0) software.
- CVE-2017-18671An issue was discovered on Samsung mobile devices with L(5.0/5.1), M(6.0), and N(7.x) software.
- CVE-2017-18672An issue was discovered on Samsung mobile devices with L(5.0/5.1), M(6.0), and N(7.x) software.
- CVE-2017-18673An issue was discovered on Samsung mobile devices with N(7.x) software.
- CVE-2017-18674An issue was discovered on Samsung mobile devices with N(7.0) software.
- CVE-2017-18675An issue was discovered on Samsung mobile devices with M(6.0) and N(7.x) (Exynos7420 or Exynox8890 chipsets) software.
- CVE-2017-18676An issue was discovered on Samsung mobile devices with N(7.0) (Qualcomm chipsets) software.
- CVE-2017-18677An issue was discovered on Samsung mobile devices with M(6.0) and N(7.x) software.
- CVE-2017-18678An issue was discovered on Samsung mobile devices with KK(4.4), L(5.0/5.1), M(6.0), and N(7.x) software.
- CVE-2020-11561In NCH Express Invoice 7.25, an authenticated low-privilege user can enter a crafted URL to access higher-privileged functionalities such as
- CVE-2017-18679An issue was discovered on Samsung mobile devices with M(6.0) software.
- CVE-2017-18680An issue was discovered on Samsung mobile devices with L(5.0/5.1) and M(6.0) (tablets) software.
- CVE-2017-18681An issue was discovered on Samsung Galaxy S5 mobile devices with software through 2016-12-20 (Qualcomm AP chipsets).
- CVE-2017-18682An issue was discovered on Samsung mobile devices with KK(4.4), L(5.0/5.1), M(6.0), and N(7.0) software.
- CVE-2017-18683An issue was discovered on Samsung mobile devices with L(5.0/5.1) and M(6.0) software.
- CVE-2017-18684An issue was discovered on Samsung mobile devices with L(5.0/5.1) and M(6.0) software.
- CVE-2017-18685An issue was discovered on Samsung mobile devices with KK(4.4), L(5.0/5.1), and M(6.0) software.
- CVE-2017-18686An issue was discovered on Samsung mobile devices with M(6.0) and N(7.0) software.
- CVE-2017-18687An issue was discovered on Samsung mobile devices with KK(4.4), L(5.0/5.1), M(6.0), and N(7.0) software.
- CVE-2017-18688An issue was discovered on Samsung mobile devices with L(5.1), M(6.0), and N(7.0) software.
- CVE-2017-18689An issue was discovered on Samsung mobile devices with M(6.0) and N(7.0) (Exynos5433, Exynos7420, or Exynos7870 chipsets) software.
- CVE-2017-18690An issue was discovered on Samsung mobile devices with KK(4.4), L(5.0/5.1), M(6.0), and N(7.0) (Exynos54xx, Exynos7420, Exynos8890, or Exyno
- CVE-2017-18691An issue was discovered on Samsung mobile devices with M(6.0) and N(7.0) (Exynos8890 chipsets) software.
- CVE-2017-18692An issue was discovered on Samsung mobile devices with M(6.0) and N(7.0) (MSM8939, MSM8996, MSM8998, Exynos7580, Exynos8890, or Exynos8895 c
- CVE-2017-18693An issue was discovered on Samsung mobile devices with KK(4.4), L(5.0/5.1), M(6.0), and N(7.0) software.
- CVE-2017-18694An issue was discovered on Samsung mobile devices with software through 2016-10-25 (Exynos5 chipsets).
- CVE-2017-18695An issue was discovered on Samsung mobile devices with KK(4.4), L(5.0/5.1), M(6.0), and N(7.0) software.
- CVE-2020-11608An issue was discovered in the Linux kernel before 5.6.1.
- CVE-2017-18696An issue was discovered on Samsung mobile devices with M(6.0) and N(7.0) (Exynos7420, Exynos8890, or MSM8996 chipsets) software.
- CVE-2016-11025An issue was discovered on Samsung mobile devices with software through 2016-09-13 (Exynos AP chipsets).
- CVE-2016-11026An issue was discovered on Samsung mobile devices with KK(4.4), L(5.0/5.1), and M(6.0) software.
- CVE-2016-11027An issue was discovered on Samsung mobile devices with M(6.0) software.
- CVE-2016-11028An issue was discovered on Samsung mobile devices with software through 2016-09-13 (Exynos AP chipsets).
- CVE-2016-11029An issue was discovered on Samsung mobile devices with L(5.0/5.1), M(6.0), and N(7.0) software.
- CVE-2016-11030An issue was discovered on Samsung mobile devices with KK(4.4), L(5.0/5.1), and M(6.0) (with Hrm sensor support) software.
- CVE-2016-11031An issue was discovered on Samsung mobile devices with KK(4.4), L(5.0/5.1), and M(6.0) software.
- CVE-2016-11032An issue was discovered on Samsung mobile devices with M(6.0) software.
- CVE-2016-11033An issue was discovered on Samsung mobile devices with M(6.0) software.
- CVE-2016-11034An issue was discovered on Samsung mobile devices with L(5.0/5.1) and M(6.0) software.
- CVE-2016-11035An issue was discovered on Samsung mobile devices with software through 2016-05-27 (Exynos AP chipsets).
- CVE-2016-11036An issue was discovered on Samsung mobile devices with M(6.0) software.
- CVE-2020-7618sds through 3.2.0 is vulnerable to Prototype Pollution.The library could be tricked into adding or modifying properties of the 'Object.protosds
- CVE-2020-7614npm-programmatic through 0.0.12 is vulnerable to Command Injection.The packages and option properties are concatenated together without any npm-programmatic
- CVE-2020-7613clamscan through 1.2.0 is vulnerable to Command Injection.clamscan
- CVE-2016-11038An issue was discovered on Samsung mobile devices with software through 2016-04-05 (incorporating the Samsung Professional Audio SDK).
- CVE-2020-7616express-mock-middleware through 0.0.6 is vulnerable to Prototype Pollution.express-mock-middleware
- CVE-2020-7615fsa through 0.5.1 is vulnerable to Command Injection.fsa
- CVE-2016-11039An issue was discovered on Samsung mobile devices with KK(4.4), L(5.0/5.1), and M(6.0) (AP + CP MDM9x35, or Qualcomm Onechip) software.
- CVE-2016-11040An issue was discovered on Samsung mobile devices with L(5.0/5.1) (with USB OTG MyFile2014_L_ESS support) software.
- CVE-2020-5734Classic buffer overflow in SolarWinds Dameware allows a remote, unauthenticated attacker to cause a denial of service by sending a large 'SiSolarWinds Dameware
- CVE-2016-11041An issue was discovered on Samsung mobile devices with KK(4.4) software.
- CVE-2016-11042An issue was discovered on Samsung mobile devices with L(5.0/5.1) and M(6.0) software.
- CVE-2016-11043An issue was discovered on Samsung mobile devices with M(6.0) software.
- CVE-2016-11044An issue was discovered on Samsung mobile devices with L(5.0/5.1) and M(6.0) (with Fingerprint support) software.
- CVE-2016-11045An issue was discovered on Samsung mobile devices with L(5.0/5.1) software.
- CVE-2016-11046An issue was discovered on Samsung mobile devices with JBP(4.3), KK(4.4), and L(5.0/5.1) software.
- CVE-2016-11047An issue was discovered on Samsung mobile devices with JBP(4.2) and KK(4.4) (Marvell chipsets) software.
- CVE-2016-11048An issue was discovered on Samsung mobile devices with L(5.0/5.1) (Spreadtrum or Marvell chipsets) software.
- CVE-2016-11049An issue was discovered on Samsung mobile devices with software through 2016-01-16 (Shannon333/308/310 chipsets).
- CVE-2016-11050An issue was discovered on Samsung mobile devices with S3(KK), Note2(KK), S4(L), Note3(L), and S5(L) software.
- CVE-2016-11052An issue was discovered on Samsung mobile devices with L(5.0/5.1) software.
- CVE-2016-11053An issue was discovered on Samsung mobile devices with software through 2015-11-11 (supporting FRP/RL).
- CVE-2020-2175Jenkins FitNesse Plugin 1.31 and earlier does not correctly escape report contents before showing them on the Jenkins UI, resulting in a stoJenkins project Jenkins FitNesse Plugin · org.jenkins-ci.pl…
- CVE-2020-2176Multiple form validation endpoints in Jenkins useMango Runner Plugin 1.4 and earlier do not escape values received from the useMango serviceJenkins project Jenkins useMango Runner Plugin · it.infuse.…
- CVE-2020-2173Jenkins Gatling Plugin 1.2.7 and earlier prevents Content-Security-Policy headers from being set for Gatling reports served by the plugin, rJenkins project Jenkins Gatling Plugin · org.jenkins-ci.plu…
- CVE-2020-2174Jenkins AWSEB Deployment Plugin 0.3.19 and earlier does not escape various values printed as part of form validation output, resulting in a Jenkins project Jenkins AWSEB Deployment Plugin · br.com.in…
- CVE-2020-2172Jenkins Code Coverage API Plugin 1.1.4 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.Jenkins project Jenkins Code Coverage API Plugin · io.jenki…
- CVE-2020-6171A cross-site scripting (XSS) vulnerability in the index page of the CLink Office 2.0 management console allows remote attackers to inject ar
- CVE-2020-8096Untrusted Search Path Vulnerability in High-Level Antimalware SDKBitdefender High-Level Antimalware SDK for Windows
- CVE-2020-11560NCH Express Invoice 7.25 allows local users to discover the cleartext password by reading the configuration file.