# CVEs published 2020-04-10

17 CVEs were published on April 10, 2020: 1 critical, 3 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2020-11694](https://cve.now/CVE-2020-11694.md): In JetBrains PyCharm 2019.2.5 and 2019.3 on Windows, Apple Notarization Service credentials were included. (no CVSS)
- [CVE-2020-11647](https://cve.now/CVE-2020-11647.md): In Wireshark 3.2.0 to 3.2.2, 3.0.0 to 3.0.9, and 2.6.0 to 2.6.15, the BACapp dissector could crash. (no CVSS)
- [CVE-2020-5330](https://cve.now/CVE-2020-5330.md): Dell EMC Networking X-Series firmware versions 3.0.1.2 and older, Dell EMC Networking PC5500 firmware versions 4.1.0.22 and older and Dell E (CVSS 8.1, Dell PowerConnect)
- [CVE-2015-9546](https://cve.now/CVE-2015-9546.md): An issue was discovered on Samsung mobile devices with KK(4.4) and later software through 2015-06-16. (no CVSS)
- [CVE-2020-5406](https://cve.now/CVE-2020-5406.md): PCF Autoscaling logs its database credentials (no CVSS, Pivotal VMware Tanzu Application Service for VMs)
- [CVE-2015-9547](https://cve.now/CVE-2015-9547.md): An issue was discovered on Samsung mobile devices with JBP(4.3) and KK(4.4.2) software. (no CVSS)
- [CVE-2015-8546](https://cve.now/CVE-2015-8546.md): An issue was discovered on Samsung mobile devices with software through 2015-11-12, affecting the Galaxy S6/S6 Edge, Galaxy S6 Edge+, and Ga (no CVSS)
- [CVE-2020-9056](https://cve.now/CVE-2020-9056.md): Periscope BuySpeed version 14.5 is vulnerable to stored cross-site scripting (CVSS 3.9, Periscope Holdings BuySpeed)
- [CVE-2020-11002](https://cve.now/CVE-2020-11002.md): Remote Code Execution (RCE) vulnerability in dropwizard-validation (CVSS 8.0, dropwizard · io.dropwizard:dropwizard-validation)
- [CVE-2020-5303](https://cve.now/CVE-2020-5303.md): Denial of service in Tendermint (CVSS 3.1, Tendermint · github.com/tendermint/tendermint)
- [CVE-2015-5524](https://cve.now/CVE-2015-5524.md): An issue was discovered on Samsung mobile devices with KK(4.4) and later software through 2015-05-13. (no CVSS)
- [CVE-2020-6765](https://cve.now/CVE-2020-6765.md): D-Link DSL-GS225 J1 AU\_1.0.4 devices allow an admin to execute OS commands by placing shell metacharacters after a supported CLI command, as (no CVSS)
- [CVE-2020-11669](https://cve.now/CVE-2020-11669.md): An issue was discovered in the Linux kernel before 5.2 on the powerpc platform. (no CVSS)
- [CVE-2020-1801](https://cve.now/CVE-2020-1801.md): There is an improper authentication vulnerability in several smartphones. (no CVSS, Mate 30 Pro;Mate)
- [CVE-2020-4362](https://cve.now/CVE-2020-4362.md): IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 traditional is vulnerable to a privilege escalation vulnerability when using token-b (CVSS 7.5, IBM WebSphere Application Server)
- [CVE-2020-1802](https://cve.now/CVE-2020-1802.md): There is an insufficient integrity validation vulnerability in several products. (no CVSS, OSCA-550;OSCA-550A;OSCA-550AX;OSCA-550X)
- [CVE-2020-3952](https://cve.now/CVE-2020-3952.md): Under certain conditions, vmdir that ships with VMware vCenter Server, as part of an embedded or external Platform Services Controller (PSC) (CVSS 9.8, KEV, VMware vCenter Server)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2020-04-10
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.