CVEs published April 9, 2020
30 CVEs were published on April 9, 2020: 0 critical, 1 high.
- Published
- 30
- Critical
- 0
- High
- 1
- Medium
- 5
- Low
- 0
- Unrated
- 24
- Now in CISA KEV
- 0
- Fix available
- 8
Most affected products
- WebAccess/NMS
- 8
- IPC-HX2XXX Series,IPC-HXXX5X4X Series,IPC-HX5842H,IPC-HX784…
- 2
- sqlite
- 2
- auth0.js · auth0-js
- 1
- Canonical eXtplorer
- 1
- Facebook Instagram for Android
- 1
- github.com/argoproj/argo-cd
- 1
- Juniper Networks Junos OS
- 1
- Linux kernel
- 1
- MongoDB Enterprise Kubernetes Operator
- 1
High 1
Medium, low and unrated 29
- CVE-2020-8832Ubuntu 18.04 Linux kernel i915 incomplete fix for CVE-2019-14615Ubuntu 18.04 LTS (bionic) Linux kernel
- CVE-2019-7305eXtplorer exposes /usr and /etc/extplorer over HTTPCanonical eXtplorer
- CVE-2019-18375The ASG and ProxySG management consoles are susceptible to a session hijacking vulnerability.Symantec Advanced Secure Gateway (ASG) and ProxySG
- CVE-2019-18376A CSRF token disclosure vulnerability allows a remote attacker, with access to an authenticated Management Center (MC) user's web browser hiSymantec Management Center
- CVE-2020-8834Linux kernel KVM Power8 conflicting use of HSTATE_HOST_R1Linux kernel
- CVE-2020-11668In the Linux kernel before 5.6.1, drivers/media/usb/gspca/xirlink_cit.c (aka the Xirlink camera USB driver) mishandles invalid descriptors,
- CVE-2020-8961An issue was discovered in Avira Free-Antivirus before 15.0.2004.1825.
- CVE-2020-7922Kubernetes Operator generates potentially insecure certificatesMongoDB Enterprise Kubernetes Operator
- CVE-2020-1895A large heap overflow could occur in Instagram for Android when attempting to upload an image with specially crafted dimensions.Facebook Instagram for Android
- CVE-2018-21034In Argo versions prior to v1.5.0-rc1, it was possible for authenticated Argo users to submit API calls to retrieve secrets and other manifesgithub.com/argoproj/argo-cd
- CVE-2020-5263Information disclosure through error objectauth0.js · auth0-js
- CVE-2020-9500Some products of Dahua have Denial of Service vulnerabilities.IPC-HX2XXX Series,IPC-HXXX5X4X Series,IPC-HX5842H,IPC-HX784…
- CVE-2020-9499Some Dahua products have buffer overflow vulnerabilities.IPC-HX2XXX Series,IPC-HXXX5X4X Series,IPC-HX5842H,IPC-HX784…
- CVE-2020-10619An attacker could use a specially crafted URL to delete files outside the WebAccess/NMS's (versions prior to 3.0.2) control.WebAccess/NMS
- CVE-2020-10629WebAccess/NMS (versions prior to 3.0.2) does not sanitize XML input.WebAccess/NMS
- CVE-2020-10603WebAccess/NMS (versions prior to 3.0.2) does not properly sanitize user input and may allow an attacker to inject system commands remotely.WebAccess/NMS
- CVE-2020-10631An attacker could use a specially crafted URL to delete or read files outside the WebAccess/NMS's (versions prior to 3.0.2) control.WebAccess/NMS
- CVE-2020-10625WebAccess/NMS (versions prior to 3.0.2) allows an unauthenticated remote user to create a new admin account.WebAccess/NMS
- CVE-2020-10617There are multiple ways an unauthenticated attacker could perform SQL injection on WebAccess/NMS (versions prior to 3.0.2) to gain access toWebAccess/NMS
- CVE-2020-10623Multiple vulnerabilities could allow an attacker with low privileges to perform SQL injection on WebAccess/NMS (versions prior to 3.0.2) to WebAccess/NMS
- CVE-2020-10621Multiple issues exist that allow files to be uploaded and executed on the WebAccess/NMS (versions prior to 3.0.2).WebAccess/NMS
- CVE-2020-10551QQBrowser before 10.5.3870.400 installs a Windows service TsService.exe.
- CVE-2020-11553An issue was discovered in Castle Rock SNMPc Online 12.10.10 before 2020-01-28.
- CVE-2020-11554An issue was discovered in Castle Rock SNMPc Online 12.10.10 before 2020-01-28.
- CVE-2020-11555An issue was discovered in Castle Rock SNMPc Online 12.10.10 before 2020-01-28.
- CVE-2020-11556An issue was discovered in Castle Rock SNMPc Online 12.10.10 before 2020-01-28.
- CVE-2020-11557An issue was discovered in Castle Rock SNMPc Online 12.10.10 before 2020-01-28.
- CVE-2020-11655SQLite through 3.31.1 allows attackers to cause a denial of service (segmentation fault) via a malformed window-function query because the Asqlite
- CVE-2020-11656In SQLite through 3.31.1, the ALTER TABLE implementation has a use-after-free, as demonstrated by an ORDER BY clause that belongs to a composqlite