# CVEs published 2020-04-16

166 CVEs were published on April 16, 2020: 2 critical, 27 high. Days are UTC.

- [CVE-2019-20766](https://cve.now/CVE-2019-20766.md): NETGEAR R7800 devices before 1.0.2.52 are affected by a stack-based buffer overflow by an authenticated user. (CVSS 6.8)
- [CVE-2019-20765](https://cve.now/CVE-2019-20765.md): NETGEAR R7800 devices before 1.0.2.52 are affected by a stack-based buffer overflow by an authenticated user. (CVSS 6.8)
- [CVE-2020-5266](https://cve.now/CVE-2020-5266.md): Stored XSS on back office edit page (CVSS 4.4, PrestaShop ps\_linklist)
- [CVE-2020-5273](https://cve.now/CVE-2020-5273.md): Stored XSS with custom URLs in PrestaShop module ps\_linklist (CVSS 4.1, PrestaShop ps\_linklist · prestashop/ps\_linklist)
- [CVE-2020-5294](https://cve.now/CVE-2020-5294.md): Reflected XSS with social networks fields (CVSS 4.1, PrestaShop ps\_socialfollow)
- [CVE-2019-20764](https://cve.now/CVE-2019-20764.md): NETGEAR R7800 devices before 1.0.2.52 are affected by a stack-based buffer overflow by an authenticated user. (CVSS 6.8)
- [CVE-2019-20763](https://cve.now/CVE-2019-20763.md): NETGEAR R7800 devices before 1.0.2.52 are affected by a stack-based buffer overflow by an authenticated user. (CVSS 6.8)
- [CVE-2019-20762](https://cve.now/CVE-2019-20762.md): Certain NETGEAR devices are affected by a buffer overflow by an authenticated user. (CVSS 6.8)
- [CVE-2019-20761](https://cve.now/CVE-2019-20761.md): NETGEAR R7800 devices before 1.0.2.62 are affected by command injection by an authenticated user. (CVSS 7.6)
- [CVE-2019-20760](https://cve.now/CVE-2019-20760.md): NETGEAR R9000 devices before 1.0.4.26 are affected by authentication bypass. (CVSS 8.3)
- [CVE-2019-20759](https://cve.now/CVE-2019-20759.md): NETGEAR R9000 devices before 1.0.4.26 are affected by stored XSS. (CVSS 7.4)
- [CVE-2019-20758](https://cve.now/CVE-2019-20758.md): NETGEAR R7000 devices before 1.0.9.42 are affected by a buffer overflow by an authenticated user. (CVSS 7.4)
- [CVE-2019-20757](https://cve.now/CVE-2019-20757.md): NETGEAR R7800 devices before 1.0.2.62 are affected by command injection by an authenticated user. (CVSS 6.8)
- [CVE-2019-20756](https://cve.now/CVE-2019-20756.md): Certain NETGEAR devices are affected by reflected XSS. (CVSS 7.1)
- [CVE-2019-20755](https://cve.now/CVE-2019-20755.md): Certain NETGEAR devices are affected by a stack-based buffer overflow by an authenticated user. (CVSS 6.8)
- [CVE-2019-20754](https://cve.now/CVE-2019-20754.md): Certain NETGEAR devices are affected by a buffer overflow by an authenticated user. (CVSS 6.8)
- [CVE-2019-20753](https://cve.now/CVE-2019-20753.md): Certain NETGEAR devices are affected by a stack-based buffer overflow by an unauthenticated attacker. (CVSS 8.8)
- [CVE-2019-20752](https://cve.now/CVE-2019-20752.md): Certain NETGEAR devices are affected by stored XSS. (CVSS 4.8)
- [CVE-2019-20751](https://cve.now/CVE-2019-20751.md): Certain NETGEAR devices are affected by a stack-based buffer overflow by an authenticated user. (CVSS 6.8)
- [CVE-2019-20750](https://cve.now/CVE-2019-20750.md): Certain NETGEAR devices are affected by stored XSS. (CVSS 4.8)
- [CVE-2019-20749](https://cve.now/CVE-2019-20749.md): Certain NETGEAR devices are affected by stored XSS. (CVSS 4.8)
- [CVE-2019-20748](https://cve.now/CVE-2019-20748.md): Certain NETGEAR devices are affected by a stack-based buffer overflow by an authenticated user. (CVSS 6.8)
- [CVE-2019-20747](https://cve.now/CVE-2019-20747.md): Certain NETGEAR devices are affected by a stack-based buffer overflow by an authenticated user. (CVSS 6.8)
- [CVE-2019-20746](https://cve.now/CVE-2019-20746.md): Certain NETGEAR devices are affected by reflected XSS. (CVSS 4.3)
- [CVE-2019-20745](https://cve.now/CVE-2019-20745.md): Certain NETGEAR devices are affected by command injection by an authenticated user. (CVSS 6.4)
- [CVE-2019-20744](https://cve.now/CVE-2019-20744.md): NETGEAR WAC510 devices before 5.0.10.2 are affected by disclosure of sensitive information. (CVSS 6.1)
- [CVE-2019-20743](https://cve.now/CVE-2019-20743.md): NETGEAR WAC510 devices before 8.0.1.3 are affected by stored XSS. (CVSS 5.2)
- [CVE-2019-20742](https://cve.now/CVE-2019-20742.md): NETGEAR WAC510 devices before 8.0.1.3 are affected by stored XSS. (CVSS 5.2)
- [CVE-2019-20741](https://cve.now/CVE-2019-20741.md): NETGEAR WAC510 devices before 5.0.10.2 are affected by disclosure of sensitive information. (CVSS 8.4)
- [CVE-2019-20740](https://cve.now/CVE-2019-20740.md): Certain NETGEAR devices are affected by a stack-based buffer overflow by an authenticated user. (CVSS 6.3)
- [CVE-2019-20739](https://cve.now/CVE-2019-20739.md): NETGEAR R8500 devices before v1.0.2.128 are affected by a buffer overflow by an unauthenticated attacker. (CVSS 4.3)
- [CVE-2019-20738](https://cve.now/CVE-2019-20738.md): Certain NETGEAR devices are affected by stored XSS. (CVSS 5.2)
- [CVE-2019-20737](https://cve.now/CVE-2019-20737.md): Certain NETGEAR devices are affected by a stack-based buffer overflow by an unauthenticated attacker. (CVSS 5.6)
- [CVE-2019-20736](https://cve.now/CVE-2019-20736.md): Certain NETGEAR devices are affected by a stack-based buffer overflow by an authenticated user. (CVSS 6.8)
- [CVE-2019-20735](https://cve.now/CVE-2019-20735.md): Certain NETGEAR devices are affected by a stack-based buffer overflow by an authenticated user. (CVSS 6.8)
- [CVE-2019-20734](https://cve.now/CVE-2019-20734.md): Certain NETGEAR devices are affected by a buffer overflow by an unauthenticated attacker. (CVSS 8.2)
- [CVE-2019-20733](https://cve.now/CVE-2019-20733.md): Certain NETGEAR devices are affected by a stack-based buffer overflow by an unauthenticated attacker. (CVSS 5.6)
- [CVE-2019-20732](https://cve.now/CVE-2019-20732.md): Certain NETGEAR devices are affected by command injection by an authenticated user. (CVSS 5.6)
- [CVE-2019-20731](https://cve.now/CVE-2019-20731.md): Certain NETGEAR devices are affected by a buffer overflow by an authenticated user. (CVSS 5.6)
- [CVE-2019-20730](https://cve.now/CVE-2019-20730.md): Certain NETGEAR devices are affected by SQL injection. (CVSS 8.2)
- [CVE-2019-20729](https://cve.now/CVE-2019-20729.md): Certain NETGEAR devices are affected by incorrect configuration of security settings. (CVSS 8.1)
- [CVE-2019-20728](https://cve.now/CVE-2019-20728.md): Certain NETGEAR devices are affected by a buffer overflow by an authenticated user. (CVSS 6.3)
- [CVE-2019-20727](https://cve.now/CVE-2019-20727.md): Certain NETGEAR devices are affected by command injection by an authenticated user. (CVSS 6.8)
- [CVE-2020-11825](https://cve.now/CVE-2020-11825.md): In Dolibarr 10.0.6, forms are protected with a CSRF token against CSRF attacks. (no CVSS, dolibarr/dolibarr)
- [CVE-2019-20726](https://cve.now/CVE-2019-20726.md): Certain NETGEAR devices are affected by command injection by an authenticated user. (CVSS 6.8)
- [CVE-2019-20725](https://cve.now/CVE-2019-20725.md): Certain NETGEAR devices are affected by a stack-based buffer overflow by an authenticated user. (CVSS 6.8)
- [CVE-2019-20724](https://cve.now/CVE-2019-20724.md): Certain NETGEAR devices are affected by command injection by an authenticated user. (CVSS 6.8)
- [CVE-2019-11999](https://cve.now/CVE-2019-11999.md): Potential security vulnerabilities have been identified in HPE OpenCall Media Platform (OCMP) resulting in remote arbitrary file download an (no CVSS, HPE OC Media Platform)
- [CVE-2020-11826](https://cve.now/CVE-2020-11826.md): Users can lock their notes with a password in Memono version 3.8. (no CVSS)
- [CVE-2020-11823](https://cve.now/CVE-2020-11823.md): In Dolibarr 10.0.6, if USER\_LOGIN\_FAILED is active, there is a stored XSS vulnerability on the admin tools --\> audit page. (no CVSS, dolibarr/dolibarr)
- [CVE-2020-11007](https://cve.now/CVE-2020-11007.md): Negative charge in shopping cart possible in Shopizer (CVSS 6.5, shopizer-ecommerce shopizer · com.shopizer:sm-core-model)
- [CVE-2019-19394](https://cve.now/CVE-2019-19394.md): Northern.tech CFEngine Enterprise before 3.10.7, 3.11.x and 3.12.x before 3.12.3, 3.13.x, and 3.14.x allows XSS. (no CVSS)
- [CVE-2020-11819](https://cve.now/CVE-2020-11819.md): In Rukovoditel 2.5.2, an attacker may inject an arbitrary .php file location instead of a language file and thus achieve command execution. (no CVSS)
- [CVE-2020-11820](https://cve.now/CVE-2020-11820.md): Rukovoditel 2.5.2 is affected by a SQL injection vulnerability because of improper handling of the entities\_id parameter. (no CVSS)
- [CVE-2020-7224](https://cve.now/CVE-2020-7224.md): The Aviatrix OpenVPN client through 2.5.7 on Linux, macOS, and Windows is vulnerable when OpenSSL parameters are altered from the issued val (no CVSS)
- [CVE-2020-11818](https://cve.now/CVE-2020-11818.md): In Rukovoditel 2.5.2 has a form\_session\_token value to prevent CSRF attacks. (no CVSS)
- [CVE-2019-20723](https://cve.now/CVE-2019-20723.md): Certain NETGEAR devices are affected by a stack-based buffer overflow by an authenticated user. (CVSS 6.8)
- [CVE-2019-20722](https://cve.now/CVE-2019-20722.md): Certain NETGEAR devices are affected by command injection by an authenticated user. (CVSS 6.8)
- [CVE-2020-11815](https://cve.now/CVE-2020-11815.md): In Rukovoditel 2.5.2, attackers can upload arbitrary file to the server by just changing the content-type value. (no CVSS)
- [CVE-2019-18948](https://cve.now/CVE-2019-18948.md): An issue was found in Arista EOS. (no CVSS)
- [CVE-2020-11816](https://cve.now/CVE-2020-11816.md): Rukovoditel 2.5.2 is affected by a SQL injection vulnerability because of improper handling of the reports\_id (POST) parameter. (no CVSS)
- [CVE-2020-11814](https://cve.now/CVE-2020-11814.md): A Host Header Injection vulnerability in qdPM 9.1 may allow an attacker to spoof a particular header and redirect users to malicious website (no CVSS)
- [CVE-2020-11812](https://cve.now/CVE-2020-11812.md): Rukovoditel 2.5.2 is affected by a SQL injection vulnerability because of improper handling of the filters\[0\]\[value\] or filters\[1\]\[value\] pa (no CVSS)
- [CVE-2020-11813](https://cve.now/CVE-2020-11813.md): In Rukovoditel 2.5.2, there is a stored XSS vulnerability on the configuration page via the copyright text input. (no CVSS)
- [CVE-2020-11811](https://cve.now/CVE-2020-11811.md): In qdPM 9.1, an attacker can upload a malicious .php file to the server by exploiting the Add Profile Photo capability with a crafted conten (no CVSS)
- [CVE-2020-1964](https://cve.now/CVE-2020-1964.md): It was noticed that Apache Heron 0.20.2-incubating, Release 0.20.1-incubating, and Release v-0.20.0-incubating does not configure its YAML p (no CVSS, Apache Heron · org.apache.heron:heron-simulator)
- [CVE-2019-20721](https://cve.now/CVE-2019-20721.md): Certain NETGEAR devices are affected by stored XSS. (CVSS 4.8)
- [CVE-2020-7110](https://cve.now/CVE-2020-7110.md): ClearPass is vulnerable to Stored Cross Site Scripting by allowing a malicious administrator, or a compromised administrator account, to sav (no CVSS, ClearPass Policy Manager)
- [CVE-2020-7113](https://cve.now/CVE-2020-7113.md): A vulnerability was found when an attacker, while communicating with the ClearPass management interface, is able to intercept and change par (no CVSS, ClearPass Policy Manager)
- [CVE-2020-7111](https://cve.now/CVE-2020-7111.md): A server side injection vulnerability exists which could allow an authenticated administrative user to achieve Remote Code Execution in Clea (no CVSS, ClearPass Policy Manager)
- [CVE-2020-7114](https://cve.now/CVE-2020-7114.md): A vulnerability exists allowing attackers, when present in the same network segment as ClearPass' management interface, to make changes to c (no CVSS, ClearPass Policy Manager)
- [CVE-2019-20720](https://cve.now/CVE-2019-20720.md): Certain NETGEAR devices are affected by stored XSS. (CVSS 4.8)
- [CVE-2019-20719](https://cve.now/CVE-2019-20719.md): Certain NETGEAR devices are affected by a buffer overflow by an authenticated user. (CVSS 6.8)
- [CVE-2019-20718](https://cve.now/CVE-2019-20718.md): Certain NETGEAR devices are affected by command injection by an authenticated user. (CVSS 6.8)
- [CVE-2019-20717](https://cve.now/CVE-2019-20717.md): Certain NETGEAR devices are affected by denial of service. (CVSS 4.3)
- [CVE-2019-20716](https://cve.now/CVE-2019-20716.md): Certain NETGEAR devices are affected by a stack-based buffer overflow by an unauthenticated attacker. (CVSS 6.8)
- [CVE-2019-20715](https://cve.now/CVE-2019-20715.md): Certain NETGEAR devices are affected by stored XSS. (CVSS 4.8)
- [CVE-2019-20714](https://cve.now/CVE-2019-20714.md): Certain NETGEAR devices are affected by stored XSS. (CVSS 4.8)
- [CVE-2019-20713](https://cve.now/CVE-2019-20713.md): Certain NETGEAR devices are affected by a stack-based buffer overflow by an authenticated user. (CVSS 6.8)
- [CVE-2019-20712](https://cve.now/CVE-2019-20712.md): Certain NETGEAR devices are affected by a buffer overflow by an authenticated user. (CVSS 6.8)
- [CVE-2020-4347](https://cve.now/CVE-2020-4347.md): IBM InfoSphere Information Server 11.3, 11.5, and 11.7 could be subject to attacks based on privilege escalation due to inappropriate file p (CVSS 7.3, IBM InfoSphere Information Server)
- [CVE-2020-4338](https://cve.now/CVE-2020-4338.md): IBM MQ 9.1.4 could allow a local attacker to obtain sensitive information by inclusion of sensitive data within runmqras data. (CVSS 5.1, IBM MQ)
- [CVE-2020-4260](https://cve.now/CVE-2020-4260.md): IBM UrbanCode Deploy (UCD) 7.0.5 could allow a user with special permissions to obtain sensitive information via generic processes. (CVSS 3.1, IBM UrbanCode Deploy)
- [CVE-2019-4762](https://cve.now/CVE-2019-4762.md): IBM MQ 9.0 and 9.1 is vulnerable to a denial of service attack due to an error in the Channel processing function. (CVSS 5.9, IBM MQ)
- [CVE-2019-20711](https://cve.now/CVE-2019-20711.md): Certain NETGEAR devices are affected by command injection by an authenticated user. (CVSS 7.1)
- [CVE-2019-20710](https://cve.now/CVE-2019-20710.md): Certain NETGEAR devices are affected by command injection by an authenticated user. (CVSS 7.1)
- [CVE-2019-20709](https://cve.now/CVE-2019-20709.md): Certain NETGEAR devices are affected by command injection by an authenticated user. (CVSS 7.1)
- [CVE-2019-20708](https://cve.now/CVE-2019-20708.md): Certain NETGEAR devices are affected by command injection by an authenticated user. (CVSS 7.1)
- [CVE-2019-20707](https://cve.now/CVE-2019-20707.md): Certain NETGEAR devices are affected by command injection by an authenticated user. (CVSS 8.8)
- [CVE-2019-20706](https://cve.now/CVE-2019-20706.md): Certain NETGEAR devices are affected by command injection by an authenticated user. (CVSS 8.8)
- [CVE-2019-20705](https://cve.now/CVE-2019-20705.md): Certain NETGEAR devices are affected by command injection by an authenticated user. (CVSS 6.3)
- [CVE-2019-20704](https://cve.now/CVE-2019-20704.md): Certain NETGEAR devices are affected by command injection by an authenticated user. (CVSS 6.3)
- [CVE-2019-20703](https://cve.now/CVE-2019-20703.md): Certain NETGEAR devices are affected by command injection by an authenticated user. (CVSS 6.3)
- [CVE-2019-20702](https://cve.now/CVE-2019-20702.md): Certain NETGEAR devices are affected by command injection by an authenticated user. (CVSS 6.3)
- [CVE-2019-20701](https://cve.now/CVE-2019-20701.md): Certain NETGEAR devices are affected by command injection by an authenticated user. (CVSS 7.1)
- [CVE-2019-20700](https://cve.now/CVE-2019-20700.md): Certain NETGEAR devices are affected by a stack-based buffer overflow by an unauthenticated attacker. (CVSS 5.6)
- [CVE-2019-20699](https://cve.now/CVE-2019-20699.md): Certain NETGEAR devices are affected by a buffer overflow by an unauthenticated attacker. (CVSS 7.5)
- [CVE-2019-20698](https://cve.now/CVE-2019-20698.md): Certain NETGEAR devices are affected by disclosure of sensitive information. (CVSS 6.5)
- [CVE-2019-20697](https://cve.now/CVE-2019-20697.md): Certain NETGEAR devices are affected by a stack-based buffer overflow by an unauthenticated attacker. (CVSS 8.8)
- [CVE-2019-20696](https://cve.now/CVE-2019-20696.md): Certain NETGEAR devices are affected by disclosure of sensitive information. (CVSS 9.4)
- [CVE-2019-20695](https://cve.now/CVE-2019-20695.md): Certain NETGEAR devices are affected by disclosure of sensitive information. (CVSS 9.4)
- [CVE-2019-20694](https://cve.now/CVE-2019-20694.md): Certain NETGEAR devices are affected by disclosure of sensitive information. (CVSS 5.3)
- [CVE-2019-20693](https://cve.now/CVE-2019-20693.md): Certain NETGEAR devices are affected by incorrect configuration of security settings. (CVSS 5.4)
- [CVE-2019-20692](https://cve.now/CVE-2019-20692.md): Certain NETGEAR devices are affected by a stack-based buffer overflow by an unauthenticated attacker. (CVSS 6.3)
- [CVE-2019-20691](https://cve.now/CVE-2019-20691.md): Certain NETGEAR devices are affected by CSRF. (CVSS 8.3)
- [CVE-2019-20690](https://cve.now/CVE-2019-20690.md): Certain NETGEAR devices are affected by authentication bypass. (CVSS 7.5)
- [CVE-2019-20689](https://cve.now/CVE-2019-20689.md): Certain NETGEAR devices are affected by command injection by an authenticated user. (CVSS 6.8)
- [CVE-2019-20688](https://cve.now/CVE-2019-20688.md): Certain NETGEAR devices are affected by command injection by an authenticated user. (CVSS 6.8)
- [CVE-2019-20687](https://cve.now/CVE-2019-20687.md): Certain NETGEAR devices are affected by denial of service. (CVSS 6.5)
- [CVE-2019-20686](https://cve.now/CVE-2019-20686.md): Certain NETGEAR devices are affected by a buffer overflow by an unauthenticated attacker. (CVSS 8.8)
- [CVE-2019-20685](https://cve.now/CVE-2019-20685.md): Certain NETGEAR devices are affected by a stack-based buffer overflow by an unauthenticated attacker. (CVSS 8.8)
- [CVE-2019-20684](https://cve.now/CVE-2019-20684.md): Certain NETGEAR devices are affected by a stack-based buffer overflow by an unauthenticated attacker. (CVSS 8.8)
- [CVE-2019-20683](https://cve.now/CVE-2019-20683.md): Certain NETGEAR devices are affected by a stack-based buffer overflow by an unauthenticated attacker. (CVSS 8.8)
- [CVE-2019-20682](https://cve.now/CVE-2019-20682.md): Certain NETGEAR devices are affected by a stack-based buffer overflow by an unauthenticated attacker. (CVSS 8.8)
- [CVE-2020-2179](https://cve.now/CVE-2020-2179.md): Jenkins Yaml Axis Plugin 0.2.0 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types, resulting in (no CVSS, Jenkins project Jenkins Yaml Axis Plugin · org.jenkins-ci.p…)
- [CVE-2020-2180](https://cve.now/CVE-2020-2180.md): Jenkins AWS SAM Plugin 1.2.2 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types, resulting in a (no CVSS, Jenkins project Jenkins AWS SAM Plugin · io.jenkins.plugins…)
- [CVE-2020-2177](https://cve.now/CVE-2020-2177.md): Jenkins Copr Plugin 0.3 and earlier stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by (no CVSS, Jenkins project Jenkins Copr Plugin · org.fedoraproject.jen…)
- [CVE-2020-2178](https://cve.now/CVE-2020-2178.md): Jenkins Parasoft Findings Plugin 10.4.3 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. (no CVSS, Jenkins project Jenkins Parasoft Findings Plugin · com.para…)
- [CVE-2020-3653](https://cve.now/CVE-2020-3653.md): Possible buffer over-read in windows wlan driver function due to lack of check of length of variable received from userspace in Snapdragon C (no CVSS, Qualcomm Snapdragon Compute, Snapdragon Connectivity)
- [CVE-2019-14135](https://cve.now/CVE-2019-14135.md): Possible integer overflow to buffer overflow in WLAN while parsing nonstandard NAN IE messages. (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2020-3651](https://cve.now/CVE-2020-3651.md): Active command timeout since WM status change cmd is not removed from active queue if peer sends multiple deauth frames. (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2020-3652](https://cve.now/CVE-2020-3652.md): Possible buffer over-read issue in windows x86 wlan driver function while processing beacon or request frame due to lack of check of length (no CVSS, Qualcomm Snapdragon Compute, Snapdragon Connectivity)
- [CVE-2019-14132](https://cve.now/CVE-2019-14132.md): Buffer over-write when this 0-byte buffer is typecasted to some other structure and hence memory corruption in Snapdragon Auto, Snapdragon C (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Consumer IOT, Snapdrag…)
- [CVE-2019-14134](https://cve.now/CVE-2019-14134.md): Possible out of bound access in WLAN handler when the received value of length in rx path is shorter than the expected value of country IE i (no CVSS, Qualcomm Snapdragon Compute, Snapdragon Consumer IOT, Snapd…)
- [CVE-2019-14127](https://cve.now/CVE-2019-14127.md): Possible buffer overflow while playing mkv clip due to lack of validation of atom size buffer in Snapdragon Auto, Snapdragon Compute, Snapdr (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2019-14131](https://cve.now/CVE-2019-14131.md): Out of bound write can occur in radio measurement request if STA receives multiple invalid rrm measurement request from AP in Snapdragon Aut (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2019-14116](https://cve.now/CVE-2019-14116.md): Privilege escalation by using an altered debug policy image can occur as the XPU protecting the debug policy regions are disabled during the (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2019-14122](https://cve.now/CVE-2019-14122.md): Memory failure in SKB if it fails to to add the requested padding to the skb in low memory targets or targets with major memory fragmentatio (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Mobile)
- [CVE-2019-14112](https://cve.now/CVE-2019-14112.md): Potential buffer overflow while processing CBF frames due to lack of check of buffer length before copy in Snapdragon Auto, Snapdragon Compu (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2019-14113](https://cve.now/CVE-2019-14113.md): Buffer overflow can occur in In WLAN firmware while unwraping data using CCMP cipher suite during parsing of EAPOL handshake frame in Snapdr (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2019-14114](https://cve.now/CVE-2019-14114.md): Buffer overflow in WLAN firmware while parsing GTK IE containing GTK key having length more than the buffer size in Snapdragon Auto, Snapdra (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2019-14110](https://cve.now/CVE-2019-14110.md): Buffer overflow can occur in function wlan firmware while copying association frame content if frame length is more than the maximum buffer (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2019-14111](https://cve.now/CVE-2019-14111.md): Possible buffer overflow while handling NAN reception of NMF in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Con (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2019-14104](https://cve.now/CVE-2019-14104.md): Slab-out-of-bounds access can occur if the context pointer is invalid due to lack of null check on pointer before accessing it in Snapdragon (no CVSS, Qualcomm Snapdragon Compute, Snapdragon Consumer IOT, Snapd…)
- [CVE-2019-14105](https://cve.now/CVE-2019-14105.md): Kernel was reading the CSL defined reserved field as uint16 instead of uint32 which could lead to memory overflow in Snapdragon Industrial I (no CVSS, Qualcomm Snapdragon Industrial IOT, Snapdragon Mobile)
- [CVE-2019-14070](https://cve.now/CVE-2019-14070.md): Possible use after free issue in pcm volume controls due to race condition exist in private data used in mixer controls in Snapdragon Auto, (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2019-14075](https://cve.now/CVE-2019-14075.md): Null pointer dereference issue in radio interface layer due to lack of null check in sapmodule destructor in Snapdragon Auto, Snapdragon Con (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Consumer IOT, Snapdrag…)
- [CVE-2019-14021](https://cve.now/CVE-2019-14021.md): Possible buffer overrun when processing EFS filename and payload sent over diag interface due to lack of check for filename length and paylo (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2019-14022](https://cve.now/CVE-2019-14022.md): Error occurs While extracting the ipv6\_header having an invalid length due to lack of length check in Snapdragon Auto, Snapdragon Compute, S (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2019-14033](https://cve.now/CVE-2019-14033.md): Multiple Read overflows issue due to improper length check while decoding tau reject/tau accept/detach request/attach reject/attach accept i (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2019-14019](https://cve.now/CVE-2019-14019.md): Multiple Read overflows issue due to improper length check while decoding RAU accept/PDN disconnect Rej/Modify EPS ctxt req/bearer resource (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2019-14020](https://cve.now/CVE-2019-14020.md): Multiple Read overflows issue due to improper length check while decoding dedicated\_eps\_bearer\_req/ act\_def\_context\_req/ cs\_serv\_notificatio (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2019-14012](https://cve.now/CVE-2019-14012.md): Possibility of null pointer deference as the array of video codecs from media info is referenced without null checking while processing SDP (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2019-14018](https://cve.now/CVE-2019-14018.md): Possible out of bound array access as there is no check on carrier index passed in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2019-14009](https://cve.now/CVE-2019-14009.md): Out of bound memory access while processing TZ command handler due to improper input validation on response length received from user in Sna (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2019-14011](https://cve.now/CVE-2019-14011.md): Multiple Read overflows issue due to improper length check while decoding 3G attach accept/ SMS/ pdn connection reject/ esm data transport/ (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2019-14001](https://cve.now/CVE-2019-14001.md): Wrong public key usage from existing oem\_keystore for hash generation in Snapdragon Auto, Snapdragon Consumer IOT, Snapdragon Industrial IOT (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Consumer IOT, Snapdrag…)
- [CVE-2019-14007](https://cve.now/CVE-2019-14007.md): Due to the use of non-time-constant comparison functions there is issue in timing side channels which can be used as a potential side channe (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2019-10624](https://cve.now/CVE-2019-10624.md): While handling the vendor command there is an integer truncation issue that could yield a buffer overflow due to int data type copied to u8 (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2019-10625](https://cve.now/CVE-2019-10625.md): Out of bound access in diag services when DCI command buffer reallocation is not done properly with required capacity in Snapdragon Auto, Sn (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2019-10622](https://cve.now/CVE-2019-10622.md): Out of bound memory access can happen while parsing ADSP message due to lack of check of size of payload received from userspace in Snapdrag (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2019-10623](https://cve.now/CVE-2019-10623.md): Possible integer overflow can happen in host driver while processing user controlled string due to improper validation on data received. (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2019-10610](https://cve.now/CVE-2019-10610.md): Possible buffer over read when trying to process SDP message Video media line with frame-size attribute in video Media line in Snapdragon Au (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2019-10620](https://cve.now/CVE-2019-10620.md): Kernel memory error in debug module due to improper check of user data length before copying into memory in Snapdragon Auto, Snapdragon Cons (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Consumer Electronics C…)
- [CVE-2019-10621](https://cve.now/CVE-2019-10621.md): Use after free issue when MAP and UNMAP calls at same time as data structure used my MAP may be freed by UNMAP function in Snapdragon Auto, (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon In…)
- [CVE-2019-10608](https://cve.now/CVE-2019-10608.md): Information disclosure issue occurs as there is no binding between the secure keypad session and the secure display session that allows user (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2019-10609](https://cve.now/CVE-2019-10609.md): Out of bound write can happen due to lack of check of array index value while calculating it. (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2019-10588](https://cve.now/CVE-2019-10588.md): Copying RTCP messages into the output buffer without checking the destination buffer size which could lead to a remote stack overflow. (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2019-10589](https://cve.now/CVE-2019-10589.md): Lack of length check of response buffer can lead to buffer over-flow while GP command response buffer handling in Snapdragon Auto, Snapdrago (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2019-10574](https://cve.now/CVE-2019-10574.md): Lack of boundary checks for data offsets received from HLOS can lead to out-of-bound read in Snapdragon Auto, Snapdragon Compute, Snapdragon (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2019-10575](https://cve.now/CVE-2019-10575.md): Wlan binary which is not signed with OEMs RoT is working on secure device without authentication failure in Snapdragon Compute, Snapdragon C (no CVSS, Qualcomm Snapdragon Compute, Snapdragon Consumer IOT, Snapd…)
- [CVE-2019-10547](https://cve.now/CVE-2019-10547.md): When issuing IOCTL calls to ION, Memory leak can occur due to failure in unassign pages under certain conditions in Snapdragon Auto, Snapdra (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2019-10551](https://cve.now/CVE-2019-10551.md): String error while processing non standard SIP messages received can lead to buffer overread and then denial of service in Snapdragon Auto, (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2019-10556](https://cve.now/CVE-2019-10556.md): Missing length check before copying the data from kernel space to userspace through the copy function can lead to buffer overflow in some ca (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2019-10483](https://cve.now/CVE-2019-10483.md): Side channel issue in QTEE due to usage of non-time-constant comparison function such as memcmp or strcmp in Snapdragon Auto, Snapdragon Com (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2019-10523](https://cve.now/CVE-2019-10523.md): Target specific data is being sent to remote server and leads to information exposure in Snapdragon Auto, Snapdragon Compute, Snapdragon Con (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2020-04-16
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.