CVEs published April 14, 2020
74 CVEs were published on April 14, 2020: 5 critical, 10 high.
- Published
- 74
- Critical
- 5
- High
- 10
- Medium
- 24
- Low
- 0
- Unrated
- 35
- Now in CISA KEV
- 0
- Fix available
- 36
Most affected products
- SAP SE SAP Business Objects Business Intelligence Platform
- 9
- SAP SE SAP NetWeaver AS ABAP
- 3
- Grandstream GXP1600 Series
- 2
- Lenovo Vantage
- 2
- SAP SE SAP BusinessObjects Business Intelligence Platform
- 2
- SAP SE SAP Commerce
- 2
- Siemens Climatix POL908 · Siemens Climatix POL909
- 2
- Canonical pc-kernel
- 1
- fraction oasis · @fraction/oasis
- 1
- git
- 1
Critical 5
- CVE-2020-5260malicious URLs may cause Git to present stored credentials to the wrong servergit
- CVE-2020-6225SAP NetWeaver (Knowledge Management), versions (KMC-CM - 7.00, 7.01, 7.02, 7.30, 7.31, 7.40, 7.50 and KMC-WPC 7.30, 7.31, 7.40, 7.50), does SAP SE SAP NetWeaver (Knowledge Management)
- CVE-2020-6238SAP Commerce, versions - 6.6, 6.7, 1808, 1811, 1905, does not process XML input securely in the Rest API from Servlet xyformsweb, leading toSAP SE SAP Commerce
- CVE-2020-6230SAP OrientDB, version 3.0, allows an authenticated attacker with script execute/write permissions to inject code that can be executed by theSAP SE SAP OrientDB
- CVE-2020-6219SAP Business Objects Business Intelligence Platform (CrystalReports WebForm Viewer), versions 4.1, 4.2, and Crystal Reports for VS version 2SAP SE SAP Business Objects Business Intelligence Platform…
High 10
- CVE-2020-8327A privilege escalation vulnerability was reported in LenovoBatteryGaugePackage for Lenovo System Interface Foundation bundled in Lenovo VantLenovo Vantage
- CVE-2020-8319A privilege escalation vulnerability was reported in Lenovo System Interface Foundation prior to version 1.1.19.3 that could allow an authenLenovo System Interface Foundation
- CVE-2020-8318A privilege escalation vulnerability was reported in the LenovoSystemUpdatePlugin for Lenovo System Interface Foundation prior to version thLenovoSystemUpdatePlugin for Lenovo System Interface Founda…
- CVE-2019-19301A vulnerability has been identified in SCALANCE X200-4P IRT, SCALANCE X201-3P IRT, SCALANCE X201-3P IRT PRO, SCALANCE X202-2IRT, SCALANCE X2Siemens SCALANCE X200-4P IRT · Siemens SCALANCE X201-3P… +50
- CVE-2020-6236SAP Landscape Management, version 3.0, and SAP Adaptive Extensions, version 1.0, allows an attacker with admin_group privileges to change owSAP SE SAP Landscape Management · SAP SE SAP Adaptive Exten…
- CVE-2020-6234SAP Host Agent, version 7.21, allows an attacker with admin privileges to use the operation framework to gain root privileges over the underSAP SE SAP Host Agent
- CVE-2020-6237Under certain conditions, SAP Business Objects Business Intelligence Platform, version 4.1, 4.2, dswsbobje web application allows an attackeSAP SE SAP Business Objects Business Intelligence Platform
- CVE-2020-6235SAP Solution Manager (Diagnostics Agent), version 7.2, does not perform the authentication check for the functionalities of the Collector SiSAP SE SAP Solution Manager
- CVE-2019-11480Ubuntu kernel snap build process could use unauthenticated sourcesCanonical pc-kernel
- CVE-2019-19300A vulnerability has been identified in Development/Evaluation Kits for PROFINET IO: EK-ERTEC 200, Development/Evaluation Kits for PROFINET ISiemens Development/Evaluation Kits for PROFINET IO: EK… +59
Medium, low and unrated 59
- CVE-2020-11003CSRF and DNS Rebinding in Oasisfraction oasis · @fraction/oasis
- CVE-2020-11001Possible XSS attack in Wagtailwagtail
- CVE-2020-11758An issue was discovered in OpenEXR before 2.4.1.
- CVE-2020-11759An issue was discovered in OpenEXR before 2.4.1.
- CVE-2020-11760An issue was discovered in OpenEXR before 2.4.1.
- CVE-2020-11761An issue was discovered in OpenEXR before 2.4.1.
- CVE-2020-11762An issue was discovered in OpenEXR before 2.4.1.
- CVE-2020-11763An issue was discovered in OpenEXR before 2.4.1.
- CVE-2020-11764An issue was discovered in OpenEXR before 2.4.1.
- CVE-2020-11765An issue was discovered in OpenEXR before 2.4.1.
- CVE-2020-11005Internal NCryptDecrypt method could be used externally from WindowsHello library.SeppPenner WindowsHello · HaemmerElectronics.SeppPenner.Win…
- CVE-2020-8324A vulnerability was reported in LenovoAppScenarioPluginSystem for Lenovo System Interface Foundation prior to version 1.2.184.31 that could LenovoAppScenarioPluginSystem for Lenovo System Interface F…
- CVE-2020-8316A vulnerability was reported in Lenovo Vantage prior to version 10.2003.10.0 that could allow an authenticated user to read files on the sysLenovo Vantage
- CVE-2020-11723Cellebrite UFED 5.0 through 7.29 uses four hardcoded RSA private keys to authenticate to the ADB daemon on target devices.
- CVE-2020-9384An Insecure Direct Object Reference (IDOR) vulnerability in the Change Password feature of Subex ROC Partner Settlement 10.5 allows remote a
- CVE-2019-10939A vulnerability has been identified in TIM 3V-IE (incl.Siemens AG TIM 3V-IE · Siemens AG TIM 4R-IE
- CVE-2020-7574A vulnerability has been identified in Climatix POL908 (BACnet/IP module) (All versions), Climatix POL909 (AWM module) (All versions < V11.3Siemens Climatix POL908 · Siemens Climatix POL909
- CVE-2020-7575A vulnerability has been identified in Climatix POL908 (BACnet/IP module) (All versions), Climatix POL909 (AWM module) (All versions < V11.3Siemens Climatix POL908 · Siemens Climatix POL909
- CVE-2020-6211SAP Business Objects Business Intelligence Platform (AdminTools), versions 4.1, 4.2, allows an attacker to redirect users to a malicious sitSAP SE SAP Business Objects Business Intelligence Platform
- CVE-2020-6217SAP NetWeaver AS ABAP Business Server Pages Test Application IT00, versions 700, 701, 702, 730, 731, 740, 750, 751, 752, 753, 754, does not SAP SE SAP NetWeaver AS ABAP
- CVE-2020-6195SAP Business Objects Business Intelligence Platform (CMC), version 4.1, 4.2, shows cleartext password in the response, leading to InformatioSAP SE SAP Business Objects Business Intelligence Platform
- CVE-2019-14326An issue was discovered in AndyOS Andy versions up to 46.11.113.
- CVE-2018-6402Ecobee Ecobee4 4.2.0.171 devices can be forced to deauthenticate and connect to an unencrypted Wi-Fi network with the same SSID, even if the
- CVE-2020-6232SAP Commerce, versions 1811, 1905, does not perform necessary authorization checks for an anonymous user, due to Missing Authorization CheckSAP SE SAP Commerce
- CVE-2020-6233SAP S/4 HANA (Financial Products Subledger and Banking Services), versions - FSAPPL 400, 450, 500 and S4FPSL 100, allows an authenticated usSAP SE SAP S/4 HANA (Financial Products Subledger and Banki…
- CVE-2020-6226SAP Business Objects Business Intelligence Platform (Web Intelligence HTML interface), version 4.2, does not sufficiently encode user-controSAP SE SAP Business Objects Business Intelligence Platform
- CVE-2020-6231SAP Business Objects Business Intelligence Platform (Web Intelligence HTML interface), version 4.2, does not sufficiently encode user-controSAP SE SAP Business Objects Business Intelligence Platform
- CVE-2020-6228SAP Business Client, versions 6.5, 7.0, does not perform necessary integrity checks which could be exploited by an attacker under certain coSAP SE SAP Business Client
- CVE-2020-6224SAP NetWeaver AS Java (HTTP Service), versions 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, allows an attacker with administrator privileges toSAP SE SAP NetWeaver AS Java
- CVE-2020-6229SAP NetWeaver AS ABAP (Business Server Pages application CRM_BSP_FRAME), versions 700, 701, 702, 710, 711, 730, 731, 740, 750, 751, 752, 75ASAP SE SAP NetWeaver AS ABAP
- CVE-2020-6227SAP Business Objects Business Intelligence Platform (CMS / Auditing issues), version 4.2, allows attacker to send specially crafted GIOP pacSAP SE SAP Business Objects Business Intelligence Platform
- CVE-2020-6222SAP Business Objects Business Intelligence Platform (Web Intelligence HTML interface), versions 4.1, 4.2, does not sufficiently encode user-SAP SE SAP BusinessObjects Business Intelligence Platform
- CVE-2020-6216SAP Business Objects Business Intelligence Platform (BI Launchpad), version 4.2, does not sufficiently encode user-controlled inputs, resultSAP SE SAP Business Objects Business Intelligence Platform
- CVE-2020-6221Web Intelligence HTML interface in SAP Business Objects Business Intelligence Platform, versions 4.1, 4.2, does not sufficiently encode userSAP SE SAP BusinessObjects Business Intelligence Platform
- CVE-2020-6223The open document of SAP Business Objects Business Intelligence Platform, versions 4.1, 4.2, allows an attacker to modify certain error pageSAP SE SAP Business Objects Business Intelligence Platform
- CVE-2020-6218Admin tools and Query Builder in SAP Business Objects Business Intelligence Platform, versions 4.1, 4.2, allows an attacker to access informSAP SE SAP Business Objects Business Intelligence Platform
- CVE-2020-6214SAP S/4HANA (Financial Products Subledger), version 100, uses an incorrect authorization object in some reports.SAP SE SAP S/4HANA
- CVE-2019-18822A privilege escalation vulnerability in ZOOM Call Recording 6.3.1 allows its user account (i.e., the account under which the program runs -
- CVE-2020-10384An issue was discovered in the MB CONNECT LINE mymbCONNECT24 and mbCONNECT24 software in all versions through 2.6.1.
- CVE-2020-10383An issue was discovered in the MB CONNECT LINE mymbCONNECT24 and mbCONNECT24 software in all versions through 2.5.0.
- CVE-2020-10382An issue was discovered in the MB CONNECT LINE mymbCONNECT24 and mbCONNECT24 software in all versions through 2.5.0.
- CVE-2020-10381An issue was discovered in the MB CONNECT LINE mymbCONNECT24 and mbCONNECT24 software in all versions through 2.5.0.
- CVE-2020-7802The Synergy Systems & Solutions (SSS) HUSKY RTU 6049-E70, with firmware Versions 5.0 and prior, has an Incorrect Default Permissions (CWE-27
- CVE-2020-7801The Synergy Systems & Solutions (SSS) HUSKY RTU 6049-E70, with firmware Versions 5.0 and prior, has an Exposure of Sensitive Information to
- CVE-2020-7800The Synergy Systems & Solutions (SSS) HUSKY RTU 6049-E70, with firmware Versions 5.0 and prior, has an Improper Check for Unusual or Excepti
- CVE-2019-16879The Synergy Systems & Solutions (SSS) HUSKY RTU 6049-E70, with firmware Versions 5.0 and prior, has a Missing Authentication for Critical Fu
- CVE-2020-7958An issue was discovered on OnePlus 7 Pro devices before 10.0.3.GM21BA.
- CVE-2020-4151IBM QRadar SIEM 7.3.0 through 7.3.3 could allow an authenticated attacker to perform unauthorized actions due to improper input validation.IBM QRadar SIEM
- CVE-2020-9004A remote authenticated authorization-bypass vulnerability in Wowza Streaming Engine 4.8.0 and earlier allows any read-only user to issue req
- CVE-2020-9461Octech Oempro 4.7 through 4.11 allow stored XSS by an authenticated user.
- CVE-2020-9460Octech Oempro 4.7 through 4.11 allow XSS by an authenticated user.
- CVE-2020-5739Grandstream GXP1600 series firmware 1.0.4.152 and below is vulnerable to authenticated remote command execution when an attacker adds an OpeGrandstream GXP1600 Series
- CVE-2020-5738Grandstream GXP1600 series firmware 1.0.4.152 and below is vulnerable to authenticated remote command execution when an attacker uploads a sGrandstream GXP1600 Series
- CVE-2020-11743An issue was discovered in Xen through 4.13.x, allowing guest OS users to cause a denial of service because of a bad error path in GNTTABOP_
- CVE-2020-11742An issue was discovered in Xen through 4.13.x, allowing guest OS users to cause a denial of service because of bad continuation handling in
- CVE-2020-11741An issue was discovered in xenoprof in Xen through 4.13.x, allowing guest OS users (with active profiling) to obtain sensitive information a
- CVE-2020-11740An issue was discovered in xenoprof in Xen through 4.13.x, allowing guest OS users (without active profiling) to obtain sensitive informatio
- CVE-2020-11739An issue was discovered in Xen through 4.13.x, allowing guest OS users to cause a denial of service or possibly gain privileges because of m
- CVE-2020-6215SAP NetWeaver AS ABAP Business Server Pages Test Application IT00, versions 700, 701, 702, 730, 731, 740, 750, 751, 752, 753, 754, allows anSAP SE SAP NetWeaver AS ABAP