# CVEs published 2020-04-14

74 CVEs were published on April 14, 2020: 5 critical, 10 high. Days are UTC.

- [CVE-2020-11003](https://cve.now/CVE-2020-11003.md): CSRF and DNS Rebinding in Oasis (CVSS 4.8, fraction oasis · @fraction/oasis)
- [CVE-2020-11001](https://cve.now/CVE-2020-11001.md): Possible XSS attack in Wagtail (CVSS 5.8, wagtail)
- [CVE-2020-5260](https://cve.now/CVE-2020-5260.md): malicious URLs may cause Git to present stored credentials to the wrong server (CVSS 9.3, git)
- [CVE-2020-11758](https://cve.now/CVE-2020-11758.md): An issue was discovered in OpenEXR before 2.4.1. (no CVSS)
- [CVE-2020-11759](https://cve.now/CVE-2020-11759.md): An issue was discovered in OpenEXR before 2.4.1. (no CVSS)
- [CVE-2020-11760](https://cve.now/CVE-2020-11760.md): An issue was discovered in OpenEXR before 2.4.1. (no CVSS)
- [CVE-2020-11761](https://cve.now/CVE-2020-11761.md): An issue was discovered in OpenEXR before 2.4.1. (no CVSS)
- [CVE-2020-11762](https://cve.now/CVE-2020-11762.md): An issue was discovered in OpenEXR before 2.4.1. (no CVSS)
- [CVE-2020-11763](https://cve.now/CVE-2020-11763.md): An issue was discovered in OpenEXR before 2.4.1. (no CVSS)
- [CVE-2020-11764](https://cve.now/CVE-2020-11764.md): An issue was discovered in OpenEXR before 2.4.1. (no CVSS)
- [CVE-2020-11765](https://cve.now/CVE-2020-11765.md): An issue was discovered in OpenEXR before 2.4.1. (no CVSS)
- [CVE-2020-11005](https://cve.now/CVE-2020-11005.md): Internal NCryptDecrypt method could be used externally from WindowsHello library. (CVSS 5.1, SeppPenner WindowsHello · HaemmerElectronics.SeppPenner.Win…)
- [CVE-2020-8327](https://cve.now/CVE-2020-8327.md): A privilege escalation vulnerability was reported in LenovoBatteryGaugePackage for Lenovo System Interface Foundation bundled in Lenovo Vant (CVSS 7.3, Lenovo Vantage)
- [CVE-2020-8324](https://cve.now/CVE-2020-8324.md): A vulnerability was reported in LenovoAppScenarioPluginSystem for Lenovo System Interface Foundation prior to version 1.2.184.31 that could (CVSS 5.0, LenovoAppScenarioPluginSystem for Lenovo System Interface F…)
- [CVE-2020-8319](https://cve.now/CVE-2020-8319.md): A privilege escalation vulnerability was reported in Lenovo System Interface Foundation prior to version 1.1.19.3 that could allow an authen (CVSS 7.3, Lenovo System Interface Foundation)
- [CVE-2020-8318](https://cve.now/CVE-2020-8318.md): A privilege escalation vulnerability was reported in the LenovoSystemUpdatePlugin for Lenovo System Interface Foundation prior to version th (CVSS 7.3, LenovoSystemUpdatePlugin for Lenovo System Interface Founda…)
- [CVE-2020-8316](https://cve.now/CVE-2020-8316.md): A vulnerability was reported in Lenovo Vantage prior to version 10.2003.10.0 that could allow an authenticated user to read files on the sys (CVSS 4.4, Lenovo Vantage)
- [CVE-2020-11723](https://cve.now/CVE-2020-11723.md): Cellebrite UFED 5.0 through 7.29 uses four hardcoded RSA private keys to authenticate to the ADB daemon on target devices. (no CVSS)
- [CVE-2020-9384](https://cve.now/CVE-2020-9384.md): An Insecure Direct Object Reference (IDOR) vulnerability in the Change Password feature of Subex ROC Partner Settlement 10.5 allows remote a (no CVSS)
- [CVE-2019-10939](https://cve.now/CVE-2019-10939.md): A vulnerability has been identified in TIM 3V-IE (incl. (no CVSS, Siemens AG TIM 3V-IE · Siemens AG TIM 4R-IE)
- [CVE-2019-19301](https://cve.now/CVE-2019-19301.md): A vulnerability has been identified in SCALANCE X200-4P IRT, SCALANCE X201-3P IRT, SCALANCE X201-3P IRT PRO, SCALANCE X202-2IRT, SCALANCE X2 (CVSS 7.5, Siemens SCALANCE X200-4P IRT · Siemens SCALANCE X201-3P… +50)
- [CVE-2020-7574](https://cve.now/CVE-2020-7574.md): A vulnerability has been identified in Climatix POL908 (BACnet/IP module) (All versions), Climatix POL909 (AWM module) (All versions \< V11.3 (no CVSS, Siemens Climatix POL908 · Siemens Climatix POL909)
- [CVE-2020-7575](https://cve.now/CVE-2020-7575.md): A vulnerability has been identified in Climatix POL908 (BACnet/IP module) (All versions), Climatix POL909 (AWM module) (All versions \< V11.3 (no CVSS, Siemens Climatix POL908 · Siemens Climatix POL909)
- [CVE-2020-6211](https://cve.now/CVE-2020-6211.md): SAP Business Objects Business Intelligence Platform (AdminTools), versions 4.1, 4.2, allows an attacker to redirect users to a malicious sit (CVSS 6.1, SAP SE SAP Business Objects Business Intelligence Platform)
- [CVE-2020-6217](https://cve.now/CVE-2020-6217.md): SAP NetWeaver AS ABAP Business Server Pages Test Application IT00, versions 700, 701, 702, 730, 731, 740, 750, 751, 752, 753, 754, does not (CVSS 6.1, SAP SE SAP NetWeaver AS ABAP)
- [CVE-2020-6225](https://cve.now/CVE-2020-6225.md): SAP NetWeaver (Knowledge Management), versions (KMC-CM - 7.00, 7.01, 7.02, 7.30, 7.31, 7.40, 7.50 and KMC-WPC 7.30, 7.31, 7.40, 7.50), does (CVSS 9.1, SAP SE SAP NetWeaver (Knowledge Management))
- [CVE-2020-6195](https://cve.now/CVE-2020-6195.md): SAP Business Objects Business Intelligence Platform (CMC), version 4.1, 4.2, shows cleartext password in the response, leading to Informatio (CVSS 6.4, SAP SE SAP Business Objects Business Intelligence Platform)
- [CVE-2019-14326](https://cve.now/CVE-2019-14326.md): An issue was discovered in AndyOS Andy versions up to 46.11.113. (no CVSS)
- [CVE-2018-6402](https://cve.now/CVE-2018-6402.md): Ecobee Ecobee4 4.2.0.171 devices can be forced to deauthenticate and connect to an unencrypted Wi-Fi network with the same SSID, even if the (no CVSS)
- [CVE-2020-6238](https://cve.now/CVE-2020-6238.md): SAP Commerce, versions - 6.6, 6.7, 1808, 1811, 1905, does not process XML input securely in the Rest API from Servlet xyformsweb, leading to (CVSS 9.3, SAP SE SAP Commerce)
- [CVE-2020-6236](https://cve.now/CVE-2020-6236.md): SAP Landscape Management, version 3.0, and SAP Adaptive Extensions, version 1.0, allows an attacker with admin\_group privileges to change ow (CVSS 7.2, SAP SE SAP Landscape Management · SAP SE SAP Adaptive Exten…)
- [CVE-2020-6234](https://cve.now/CVE-2020-6234.md): SAP Host Agent, version 7.21, allows an attacker with admin privileges to use the operation framework to gain root privileges over the under (CVSS 7.2, SAP SE SAP Host Agent)
- [CVE-2020-6232](https://cve.now/CVE-2020-6232.md): SAP Commerce, versions 1811, 1905, does not perform necessary authorization checks for an anonymous user, due to Missing Authorization Check (CVSS 5.3, SAP SE SAP Commerce)
- [CVE-2020-6237](https://cve.now/CVE-2020-6237.md): Under certain conditions, SAP Business Objects Business Intelligence Platform, version 4.1, 4.2, dswsbobje web application allows an attacke (CVSS 7.5, SAP SE SAP Business Objects Business Intelligence Platform)
- [CVE-2020-6235](https://cve.now/CVE-2020-6235.md): SAP Solution Manager (Diagnostics Agent), version 7.2, does not perform the authentication check for the functionalities of the Collector Si (CVSS 8.6, SAP SE SAP Solution Manager)
- [CVE-2020-6233](https://cve.now/CVE-2020-6233.md): SAP S/4 HANA (Financial Products Subledger and Banking Services), versions - FSAPPL 400, 450, 500 and S4FPSL 100, allows an authenticated us (CVSS 4.3, SAP SE SAP S/4 HANA (Financial Products Subledger and Banki…)
- [CVE-2020-6230](https://cve.now/CVE-2020-6230.md): SAP OrientDB, version 3.0, allows an authenticated attacker with script execute/write permissions to inject code that can be executed by the (CVSS 9.1, SAP SE SAP OrientDB)
- [CVE-2020-6226](https://cve.now/CVE-2020-6226.md): SAP Business Objects Business Intelligence Platform (Web Intelligence HTML interface), version 4.2, does not sufficiently encode user-contro (CVSS 5.4, SAP SE SAP Business Objects Business Intelligence Platform)
- [CVE-2020-6231](https://cve.now/CVE-2020-6231.md): SAP Business Objects Business Intelligence Platform (Web Intelligence HTML interface), version 4.2, does not sufficiently encode user-contro (CVSS 5.4, SAP SE SAP Business Objects Business Intelligence Platform)
- [CVE-2020-6228](https://cve.now/CVE-2020-6228.md): SAP Business Client, versions 6.5, 7.0, does not perform necessary integrity checks which could be exploited by an attacker under certain co (CVSS 5.3, SAP SE SAP Business Client)
- [CVE-2020-6224](https://cve.now/CVE-2020-6224.md): SAP NetWeaver AS Java (HTTP Service), versions 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, allows an attacker with administrator privileges to (CVSS 4.5, SAP SE SAP NetWeaver AS Java)
- [CVE-2020-6229](https://cve.now/CVE-2020-6229.md): SAP NetWeaver AS ABAP (Business Server Pages application CRM\_BSP\_FRAME), versions 700, 701, 702, 710, 711, 730, 731, 740, 750, 751, 752, 75A (CVSS 6.1, SAP SE SAP NetWeaver AS ABAP)
- [CVE-2020-6227](https://cve.now/CVE-2020-6227.md): SAP Business Objects Business Intelligence Platform (CMS / Auditing issues), version 4.2, allows attacker to send specially crafted GIOP pac (CVSS 5.3, SAP SE SAP Business Objects Business Intelligence Platform)
- [CVE-2020-6219](https://cve.now/CVE-2020-6219.md): SAP Business Objects Business Intelligence Platform (CrystalReports WebForm Viewer), versions 4.1, 4.2, and Crystal Reports for VS version 2 (CVSS 9.1, SAP SE SAP Business Objects Business Intelligence Platform…)
- [CVE-2020-6222](https://cve.now/CVE-2020-6222.md): SAP Business Objects Business Intelligence Platform (Web Intelligence HTML interface), versions 4.1, 4.2, does not sufficiently encode user- (CVSS 5.4, SAP SE SAP BusinessObjects Business Intelligence Platform)
- [CVE-2020-6216](https://cve.now/CVE-2020-6216.md): SAP Business Objects Business Intelligence Platform (BI Launchpad), version 4.2, does not sufficiently encode user-controlled inputs, result (CVSS 6.1, SAP SE SAP Business Objects Business Intelligence Platform)
- [CVE-2020-6221](https://cve.now/CVE-2020-6221.md): Web Intelligence HTML interface in SAP Business Objects Business Intelligence Platform, versions 4.1, 4.2, does not sufficiently encode user (CVSS 5.4, SAP SE SAP BusinessObjects Business Intelligence Platform)
- [CVE-2020-6223](https://cve.now/CVE-2020-6223.md): The open document of SAP Business Objects Business Intelligence Platform, versions 4.1, 4.2, allows an attacker to modify certain error page (CVSS 6.1, SAP SE SAP Business Objects Business Intelligence Platform)
- [CVE-2020-6218](https://cve.now/CVE-2020-6218.md): Admin tools and Query Builder in SAP Business Objects Business Intelligence Platform, versions 4.1, 4.2, allows an attacker to access inform (CVSS 5.0, SAP SE SAP Business Objects Business Intelligence Platform)
- [CVE-2020-6214](https://cve.now/CVE-2020-6214.md): SAP S/4HANA (Financial Products Subledger), version 100, uses an incorrect authorization object in some reports. (CVSS 4.7, SAP SE SAP S/4HANA)
- [CVE-2019-18822](https://cve.now/CVE-2019-18822.md): A privilege escalation vulnerability in ZOOM Call Recording 6.3.1 allows its user account (i.e., the account under which the program runs - (no CVSS)
- [CVE-2020-10384](https://cve.now/CVE-2020-10384.md): An issue was discovered in the MB CONNECT LINE mymbCONNECT24 and mbCONNECT24 software in all versions through 2.6.1. (no CVSS)
- [CVE-2020-10383](https://cve.now/CVE-2020-10383.md): An issue was discovered in the MB CONNECT LINE mymbCONNECT24 and mbCONNECT24 software in all versions through 2.5.0. (no CVSS)
- [CVE-2020-10382](https://cve.now/CVE-2020-10382.md): An issue was discovered in the MB CONNECT LINE mymbCONNECT24 and mbCONNECT24 software in all versions through 2.5.0. (no CVSS)
- [CVE-2020-10381](https://cve.now/CVE-2020-10381.md): An issue was discovered in the MB CONNECT LINE mymbCONNECT24 and mbCONNECT24 software in all versions through 2.5.0. (no CVSS)
- [CVE-2020-7802](https://cve.now/CVE-2020-7802.md): The Synergy Systems & Solutions (SSS) HUSKY RTU 6049-E70, with firmware Versions 5.0 and prior, has an Incorrect Default Permissions (CWE-27 (no CVSS)
- [CVE-2020-7801](https://cve.now/CVE-2020-7801.md): The Synergy Systems & Solutions (SSS) HUSKY RTU 6049-E70, with firmware Versions 5.0 and prior, has an Exposure of Sensitive Information to (no CVSS)
- [CVE-2020-7800](https://cve.now/CVE-2020-7800.md): The Synergy Systems & Solutions (SSS) HUSKY RTU 6049-E70, with firmware Versions 5.0 and prior, has an Improper Check for Unusual or Excepti (no CVSS)
- [CVE-2019-16879](https://cve.now/CVE-2019-16879.md): The Synergy Systems & Solutions (SSS) HUSKY RTU 6049-E70, with firmware Versions 5.0 and prior, has a Missing Authentication for Critical Fu (no CVSS)
- [CVE-2020-7958](https://cve.now/CVE-2020-7958.md): An issue was discovered on OnePlus 7 Pro devices before 10.0.3.GM21BA. (no CVSS)
- [CVE-2020-4151](https://cve.now/CVE-2020-4151.md): IBM QRadar SIEM 7.3.0 through 7.3.3 could allow an authenticated attacker to perform unauthorized actions due to improper input validation. (CVSS 6.5, IBM QRadar SIEM)
- [CVE-2020-9004](https://cve.now/CVE-2020-9004.md): A remote authenticated authorization-bypass vulnerability in Wowza Streaming Engine 4.8.0 and earlier allows any read-only user to issue req (no CVSS)
- [CVE-2020-9461](https://cve.now/CVE-2020-9461.md): Octech Oempro 4.7 through 4.11 allow stored XSS by an authenticated user. (no CVSS)
- [CVE-2020-9460](https://cve.now/CVE-2020-9460.md): Octech Oempro 4.7 through 4.11 allow XSS by an authenticated user. (no CVSS)
- [CVE-2020-5739](https://cve.now/CVE-2020-5739.md): Grandstream GXP1600 series firmware 1.0.4.152 and below is vulnerable to authenticated remote command execution when an attacker adds an Ope (no CVSS, Grandstream GXP1600 Series)
- [CVE-2020-5738](https://cve.now/CVE-2020-5738.md): Grandstream GXP1600 series firmware 1.0.4.152 and below is vulnerable to authenticated remote command execution when an attacker uploads a s (no CVSS, Grandstream GXP1600 Series)
- [CVE-2020-11743](https://cve.now/CVE-2020-11743.md): An issue was discovered in Xen through 4.13.x, allowing guest OS users to cause a denial of service because of a bad error path in GNTTABOP\_ (no CVSS)
- [CVE-2020-11742](https://cve.now/CVE-2020-11742.md): An issue was discovered in Xen through 4.13.x, allowing guest OS users to cause a denial of service because of bad continuation handling in (no CVSS)
- [CVE-2020-11741](https://cve.now/CVE-2020-11741.md): An issue was discovered in xenoprof in Xen through 4.13.x, allowing guest OS users (with active profiling) to obtain sensitive information a (no CVSS)
- [CVE-2020-11740](https://cve.now/CVE-2020-11740.md): An issue was discovered in xenoprof in Xen through 4.13.x, allowing guest OS users (without active profiling) to obtain sensitive informatio (no CVSS)
- [CVE-2020-11739](https://cve.now/CVE-2020-11739.md): An issue was discovered in Xen through 4.13.x, allowing guest OS users to cause a denial of service or possibly gain privileges because of m (no CVSS)
- [CVE-2019-11480](https://cve.now/CVE-2019-11480.md): Ubuntu kernel snap build process could use unauthenticated sources (CVSS 8.4, Canonical pc-kernel)
- [CVE-2019-19300](https://cve.now/CVE-2019-19300.md): A vulnerability has been identified in Development/Evaluation Kits for PROFINET IO: EK-ERTEC 200, Development/Evaluation Kits for PROFINET I (CVSS 7.5, Siemens Development/Evaluation Kits for PROFINET IO: EK… +59)
- [CVE-2020-6215](https://cve.now/CVE-2020-6215.md): SAP NetWeaver AS ABAP Business Server Pages Test Application IT00, versions 700, 701, 702, 730, 731, 740, 750, 751, 752, 753, 754, allows an (CVSS 6.1, SAP SE SAP NetWeaver AS ABAP)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2020-04-14
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.