# CVEs published 2020-04-09 30 CVEs were published on April 9, 2020: 0 critical, 1 high. Days are UTC. - [CVE-2020-8832](https://cve.now/CVE-2020-8832.md): Ubuntu 18.04 Linux kernel i915 incomplete fix for CVE-2019-14615 (CVSS 5.5, Ubuntu 18.04 LTS (bionic) Linux kernel) - [CVE-2019-7305](https://cve.now/CVE-2019-7305.md): eXtplorer exposes /usr and /etc/extplorer over HTTP (CVSS 5.8, Canonical eXtplorer) - [CVE-2019-18375](https://cve.now/CVE-2019-18375.md): The ASG and ProxySG management consoles are susceptible to a session hijacking vulnerability. (no CVSS, Symantec Advanced Secure Gateway (ASG) and ProxySG) - [CVE-2019-18376](https://cve.now/CVE-2019-18376.md): A CSRF token disclosure vulnerability allows a remote attacker, with access to an authenticated Management Center (MC) user's web browser hi (no CVSS, Symantec Management Center) - [CVE-2020-1633](https://cve.now/CVE-2020-1633.md): Junos OS: MX Series: Crafted packets traversing a Broadband Network Gateway (BNG) configured with IPv6 NDP proxy could lead to Denial of Service (CVSS 7.4, Juniper Networks Junos OS) - [CVE-2020-8834](https://cve.now/CVE-2020-8834.md): Linux kernel KVM Power8 conflicting use of HSTATE\_HOST\_R1 (CVSS 6.5, Linux kernel) - [CVE-2020-11668](https://cve.now/CVE-2020-11668.md): In the Linux kernel before 5.6.1, drivers/media/usb/gspca/xirlink\_cit.c (aka the Xirlink camera USB driver) mishandles invalid descriptors, (no CVSS) - [CVE-2020-8961](https://cve.now/CVE-2020-8961.md): An issue was discovered in Avira Free-Antivirus before 15.0.2004.1825. (no CVSS) - [CVE-2020-7922](https://cve.now/CVE-2020-7922.md): Kubernetes Operator generates potentially insecure certificates (CVSS 6.4, MongoDB Enterprise Kubernetes Operator) - [CVE-2020-1895](https://cve.now/CVE-2020-1895.md): A large heap overflow could occur in Instagram for Android when attempting to upload an image with specially crafted dimensions. (no CVSS, Facebook Instagram for Android) - [CVE-2018-21034](https://cve.now/CVE-2018-21034.md): In Argo versions prior to v1.5.0-rc1, it was possible for authenticated Argo users to submit API calls to retrieve secrets and other manifes (no CVSS, github.com/argoproj/argo-cd) - [CVE-2020-5263](https://cve.now/CVE-2020-5263.md): Information disclosure through error object (CVSS 5.5, auth0.js · auth0-js) - [CVE-2020-9500](https://cve.now/CVE-2020-9500.md): Some products of Dahua have Denial of Service vulnerabilities. (no CVSS, IPC-HX2XXX Series,IPC-HXXX5X4X Series,IPC-HX5842H,IPC-HX784…) - [CVE-2020-9499](https://cve.now/CVE-2020-9499.md): Some Dahua products have buffer overflow vulnerabilities. (no CVSS, IPC-HX2XXX Series,IPC-HXXX5X4X Series,IPC-HX5842H,IPC-HX784…) - [CVE-2020-10619](https://cve.now/CVE-2020-10619.md): An attacker could use a specially crafted URL to delete files outside the WebAccess/NMS's (versions prior to 3.0.2) control. (no CVSS, WebAccess/NMS) - [CVE-2020-10629](https://cve.now/CVE-2020-10629.md): WebAccess/NMS (versions prior to 3.0.2) does not sanitize XML input. (no CVSS, WebAccess/NMS) - [CVE-2020-10603](https://cve.now/CVE-2020-10603.md): WebAccess/NMS (versions prior to 3.0.2) does not properly sanitize user input and may allow an attacker to inject system commands remotely. (no CVSS, WebAccess/NMS) - [CVE-2020-10631](https://cve.now/CVE-2020-10631.md): An attacker could use a specially crafted URL to delete or read files outside the WebAccess/NMS's (versions prior to 3.0.2) control. (no CVSS, WebAccess/NMS) - [CVE-2020-10625](https://cve.now/CVE-2020-10625.md): WebAccess/NMS (versions prior to 3.0.2) allows an unauthenticated remote user to create a new admin account. (no CVSS, WebAccess/NMS) - [CVE-2020-10617](https://cve.now/CVE-2020-10617.md): There are multiple ways an unauthenticated attacker could perform SQL injection on WebAccess/NMS (versions prior to 3.0.2) to gain access to (no CVSS, WebAccess/NMS) - [CVE-2020-10623](https://cve.now/CVE-2020-10623.md): Multiple vulnerabilities could allow an attacker with low privileges to perform SQL injection on WebAccess/NMS (versions prior to 3.0.2) to (no CVSS, WebAccess/NMS) - [CVE-2020-10621](https://cve.now/CVE-2020-10621.md): Multiple issues exist that allow files to be uploaded and executed on the WebAccess/NMS (versions prior to 3.0.2). (no CVSS, WebAccess/NMS) - [CVE-2020-10551](https://cve.now/CVE-2020-10551.md): QQBrowser before 10.5.3870.400 installs a Windows service TsService.exe. (no CVSS) - [CVE-2020-11553](https://cve.now/CVE-2020-11553.md): An issue was discovered in Castle Rock SNMPc Online 12.10.10 before 2020-01-28. (no CVSS) - [CVE-2020-11554](https://cve.now/CVE-2020-11554.md): An issue was discovered in Castle Rock SNMPc Online 12.10.10 before 2020-01-28. (no CVSS) - [CVE-2020-11555](https://cve.now/CVE-2020-11555.md): An issue was discovered in Castle Rock SNMPc Online 12.10.10 before 2020-01-28. (no CVSS) - [CVE-2020-11556](https://cve.now/CVE-2020-11556.md): An issue was discovered in Castle Rock SNMPc Online 12.10.10 before 2020-01-28. (no CVSS) - [CVE-2020-11557](https://cve.now/CVE-2020-11557.md): An issue was discovered in Castle Rock SNMPc Online 12.10.10 before 2020-01-28. (no CVSS) - [CVE-2020-11655](https://cve.now/CVE-2020-11655.md): SQLite through 3.31.1 allows attackers to cause a denial of service (segmentation fault) via a malformed window-function query because the A (no CVSS, sqlite) - [CVE-2020-11656](https://cve.now/CVE-2020-11656.md): In SQLite through 3.31.1, the ALTER TABLE implementation has a use-after-free, as demonstrated by an ORDER BY clause that belongs to a compo (no CVSS, sqlite) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2020-04-09 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.