# CVEs published 2020-04-13

42 CVEs were published on April 13, 2020: 0 critical, 1 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2020-11738](https://cve.now/CVE-2020-11738.md): The Snap Creek Duplicator plugin before 1.3.28 for WordPress (and Duplicator Pro before 3.8.7.1) allows Directory Traversal via ../ in the f (CVSS 7.5, KEV)
- [CVE-2020-10642](https://cve.now/CVE-2020-10642.md): In Rockwell Automation RSLinx Classic versions 4.11.00 and prior, an authenticated local attacker could modify a registry key, which could l (no CVSS, Rockwell Automation RSLinx Classic versions 4.1.00 and prior)
- [CVE-2020-10646](https://cve.now/CVE-2020-10646.md): Fuji Electric V-Server Lite all versions prior to 4.0.9.0 contains a heap based buffer overflow. (no CVSS, Fuji Electric V-Server Lite all versions prior to)
- [CVE-2020-11736](https://cve.now/CVE-2020-11736.md): fr-archive-libarchive.c in GNOME file-roller through 3.36.1 allows Directory Traversal during extraction because it lacks a check of whether (no CVSS)
- [CVE-2020-6455](https://cve.now/CVE-2020-6455.md): Out of bounds read in WebSQL in Google Chrome prior to 81.0.4044.92 allowed a remote attacker to potentially exploit heap corruption via a c (no CVSS, Google Chrome)
- [CVE-2020-6456](https://cve.now/CVE-2020-6456.md): Insufficient validation of untrusted input in clipboard in Google Chrome prior to 81.0.4044.92 allowed a local attacker to bypass site isola (no CVSS, Google Chrome)
- [CVE-2020-6452](https://cve.now/CVE-2020-6452.md): Heap buffer overflow in media in Google Chrome prior to 80.0.3987.162 allowed a remote attacker to potentially exploit heap corruption via a (no CVSS, Google Chrome)
- [CVE-2020-6454](https://cve.now/CVE-2020-6454.md): Use after free in extensions in Google Chrome prior to 81.0.4044.92 allowed an attacker who convinced a user to install a malicious extensio (no CVSS, Google Chrome)
- [CVE-2020-6450](https://cve.now/CVE-2020-6450.md): Use after free in WebAudio in Google Chrome prior to 80.0.3987.162 allowed a remote attacker to potentially exploit heap corruption via a cr (no CVSS, Google Chrome)
- [CVE-2020-6451](https://cve.now/CVE-2020-6451.md): Use after free in WebAudio in Google Chrome prior to 80.0.3987.162 allowed a remote attacker to potentially exploit heap corruption via a cr (no CVSS, Google Chrome)
- [CVE-2020-6447](https://cve.now/CVE-2020-6447.md): Inappropriate implementation in developer tools in Google Chrome prior to 81.0.4044.92 allowed a remote attacker who had convinced the user (no CVSS, Google Chrome)
- [CVE-2020-6448](https://cve.now/CVE-2020-6448.md): Use after free in V8 in Google Chrome prior to 81.0.4044.92 allowed a remote attacker to potentially exploit heap corruption via a crafted H (no CVSS, Google Chrome)
- [CVE-2020-6445](https://cve.now/CVE-2020-6445.md): Insufficient policy enforcement in trusted types in Google Chrome prior to 81.0.4044.92 allowed a remote attacker to bypass content security (no CVSS, Google Chrome)
- [CVE-2020-6446](https://cve.now/CVE-2020-6446.md): Insufficient policy enforcement in trusted types in Google Chrome prior to 81.0.4044.92 allowed a remote attacker to bypass content security (no CVSS, Google Chrome)
- [CVE-2020-6443](https://cve.now/CVE-2020-6443.md): Insufficient data validation in developer tools in Google Chrome prior to 81.0.4044.92 allowed a remote attacker who had convinced the user (no CVSS, Google Chrome)
- [CVE-2020-6444](https://cve.now/CVE-2020-6444.md): Uninitialized use in WebRTC in Google Chrome prior to 81.0.4044.92 allowed a remote attacker to potentially exploit heap corruption via a cr (no CVSS, Google Chrome)
- [CVE-2020-6441](https://cve.now/CVE-2020-6441.md): Insufficient policy enforcement in omnibox in Google Chrome prior to 81.0.4044.92 allowed a remote attacker to bypass security UI via a craf (no CVSS, Google Chrome)
- [CVE-2020-6442](https://cve.now/CVE-2020-6442.md): Inappropriate implementation in cache in Google Chrome prior to 81.0.4044.92 allowed a remote attacker to leak cross-origin data via a craft (no CVSS, Google Chrome)
- [CVE-2020-6439](https://cve.now/CVE-2020-6439.md): Insufficient policy enforcement in navigations in Google Chrome prior to 81.0.4044.92 allowed a remote attacker to bypass security UI via a (no CVSS, Google Chrome)
- [CVE-2020-6440](https://cve.now/CVE-2020-6440.md): Inappropriate implementation in extensions in Google Chrome prior to 81.0.4044.92 allowed an attacker who convinced a user to install a mali (no CVSS, Google Chrome)
- [CVE-2020-6437](https://cve.now/CVE-2020-6437.md): Inappropriate implementation in WebView in Google Chrome prior to 81.0.4044.92 allowed a remote attacker to spoof security UI via a crafted (no CVSS, Google Chrome)
- [CVE-2020-6438](https://cve.now/CVE-2020-6438.md): Insufficient policy enforcement in extensions in Google Chrome prior to 81.0.4044.92 allowed an attacker who convinced a user to install a m (no CVSS, Google Chrome)
- [CVE-2020-6435](https://cve.now/CVE-2020-6435.md): Insufficient policy enforcement in extensions in Google Chrome prior to 81.0.4044.92 allowed a remote attacker who had compromised the rende (no CVSS, Google Chrome)
- [CVE-2020-6436](https://cve.now/CVE-2020-6436.md): Use after free in window management in Google Chrome prior to 81.0.4044.92 allowed a remote attacker to potentially exploit heap corruption (no CVSS, Google Chrome)
- [CVE-2020-6433](https://cve.now/CVE-2020-6433.md): Insufficient policy enforcement in extensions in Google Chrome prior to 81.0.4044.92 allowed a remote attacker to bypass navigation restrict (no CVSS, Google Chrome)
- [CVE-2020-6434](https://cve.now/CVE-2020-6434.md): Use after free in devtools in Google Chrome prior to 81.0.4044.92 allowed a remote attacker to potentially exploit heap corruption via a cra (no CVSS, Google Chrome)
- [CVE-2020-6431](https://cve.now/CVE-2020-6431.md): Insufficient policy enforcement in full screen in Google Chrome prior to 81.0.4044.92 allowed a remote attacker to spoof security UI via a c (no CVSS, Google Chrome)
- [CVE-2020-6432](https://cve.now/CVE-2020-6432.md): Insufficient policy enforcement in navigations in Google Chrome prior to 81.0.4044.92 allowed a remote attacker to bypass navigation restric (no CVSS, Google Chrome)
- [CVE-2020-6423](https://cve.now/CVE-2020-6423.md): Use after free in audio in Google Chrome prior to 81.0.4044.92 allowed a remote attacker to potentially exploit heap corruption via a crafte (no CVSS, Google Chrome)
- [CVE-2020-6430](https://cve.now/CVE-2020-6430.md): Type Confusion in V8 in Google Chrome prior to 81.0.4044.92 allowed a remote attacker to potentially exploit heap corruption via a crafted H (no CVSS, Google Chrome)
- [CVE-2019-1866](https://cve.now/CVE-2019-1866.md): Cisco Webex Business Suite Host Header Value Integrity Vulnerability (CVSS 3.1, Cisco Webex Business Suite)
- [CVE-2020-3126](https://cve.now/CVE-2020-3126.md): Cisco Webex Meetings Multimedia Viewer Vulnerability (CVSS 3.0, Cisco Webex Meetings Multimedia Viewer)
- [CVE-2019-13916](https://cve.now/CVE-2019-13916.md): An issue was discovered in Cypress (formerly Broadcom) WICED Studio 6.2 CYW20735B1 and CYW20819A1. (no CVSS)
- [CVE-2020-11734](https://cve.now/CVE-2020-11734.md): cgi-bin/go in CyberSolutions CyberMail 5 or later allows XSS via the ACTION parameter. (no CVSS)
- [CVE-2020-8430](https://cve.now/CVE-2020-8430.md): Stormshield Network Security 310 3.7.10 devices have an auth/lang.html?rurl= Open Redirect vulnerability on the captive portal. (no CVSS)
- [CVE-2020-11673](https://cve.now/CVE-2020-11673.md): An issue was discovered in the Responsive Poll through 1.3.4 for Wordpress. (no CVSS)
- [CVE-2020-9478](https://cve.now/CVE-2020-9478.md): An issue was discovered in Rubrik 5.0.3-2296. (no CVSS)
- [CVE-2020-8148](https://cve.now/CVE-2020-8148.md): UniFi Cloud Key firmware \< 1.1.6 contains a vulnerability that enables an attacker being able to change a device hostname by sending a malic (no CVSS, UniFi Cloud Key Gen2)
- [CVE-2020-1759](https://cve.now/CVE-2020-1759.md): A vulnerability was found in Red Hat Ceph Storage 4 and Red Hat Openshift Container Storage 4.2 where, A nonce reuse vulnerability was disco (CVSS 6.4, The Ceph Project ceph)
- [CVE-2020-11731](https://cve.now/CVE-2020-11731.md): The Media Library Assistant plugin before 2.82 for Wordpress suffers from multiple XSS vulnerabilities in all Settings/Media Library Assista (no CVSS)
- [CVE-2020-11732](https://cve.now/CVE-2020-11732.md): The Media Library Assistant plugin before 2.82 for Wordpress suffers from a Local File Inclusion vulnerability in mla\_gallery link=download. (no CVSS)
- [CVE-2020-1730](https://cve.now/CVE-2020-1730.md): A flaw was found in libssh versions before 0.8.9 and before 0.9.4 in the way it handled AES-CTR (or DES ciphers if enabled) ciphers. (CVSS 5.3, Red Hat libssh)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2020-04-13
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.