CVEs published April 17, 2020
74 CVEs were published on April 17, 2020: 0 critical, 2 high.
- Published
- 74
- Critical
- 0
- High
- 2
- Medium
- 8
- Low
- 0
- Unrated
- 64
- Now in CISA KEV
- 0
- Fix available
- 4
Most affected products
- Android
- 15
- Autodesk FBX-SDK
- 6
- OpenMRS
- 6
- IBM Maximo Asset Management
- 3
- HPE MSA 2040 SAN Storage; HPE MSA 1040 SAN Storage; HPE MSA…
- 2
- Apple iOS · Apple macOS +1
- 1
- Autodesk Dynamo BIM
- 1
- Canonical byobu
- 1
- Enterprise developer and server.
- 1
- IBM TRIRIGA Application Platform
- 1
High 2
Medium, low and unrated 72
- CVE-2020-11887svg2png 4.1.1 allows XSS with resultant SSRF via JavaScript inside an SVG document.svg2png
- CVE-2020-11886OpenNMS Horizon and Meridian allows HQL Injection in element/nodeList.htm (aka the NodeListController) via snmpParm or snmpParmValue to addC
- CVE-2020-11885WSO2 Enterprise Integrator through 6.6.0 has an XXE vulnerability where a user (with admin console access) can use the XML validator to make
- CVE-2020-11883In Divante vue-storefront-api through 1.11.1 and storefront-api through 1.0-rc.1, as used in VueStorefront PWA, unexpected HTTP requests leastorefront-api · vue-storefront-api
- CVE-2020-1751An out-of-bounds write vulnerability was found in glibc before 2.31 when handling signal trampolines on PowerPC.Red Hat glibc
- CVE-2020-5731In OpenMRS 2.9 and prior, the app parameter for the ActiveVisit's page is vulnerable to cross-site scripting.OpenMRS
- CVE-2020-5730In OpenMRS 2.9 and prior, the sessionLocation parameter for the login page is vulnerable to cross-site scripting.OpenMRS
- CVE-2020-5729In OpenMRS 2.9 and prior, the UI Framework Error Page reflects arbitrary, user-supplied input back to the browser, which can result in XSS.OpenMRS
- CVE-2020-5728OpenMRS 2.9 and prior copies "Referrer" header values into an html element named "redirectUrl" within many webpages (such as login.htm).OpenMRS
- CVE-2020-5733In OpenMRS 2.9 and prior, the export functionality of the Data Exchange Module does not properly redirect to a login page when an unauthentiOpenMRS
- CVE-2020-5732In OpenMRS 2.9 and prior, he import functionality of the Data Exchange Module does not properly redirect to a login page when an unauthenticOpenMRS
- CVE-2020-5737Stored XSS in Tenable.Sc before 5.14.0 could allow an authenticated remote attacker to craft a request to execute arbitrary script code in aTenable.Sc
- CVE-2020-0077In authorize_enroll of the FPC IRIS TrustZone app, there is a possible out of bounds read due to a missing bounds check.Android
- CVE-2020-0075In set_shared_key of the FPC IRIS TrustZone app, there is a possible out of bounds read due to a missing bounds check.Android
- CVE-2020-0076In get_auth_result of the FPC IRIS TrustZone app, there is a possible out of bounds write due to a missing bounds check.Android
- CVE-2019-2056There is a possible disclosure of RAM using a shared crypto key due to improperly used crypto.Android
- CVE-2020-0073In rw_t2t_handle_tlv_detect_rsp of rw_t2t_ndef.cc, there is a possible out of bounds write due to a missing bounds check.Android
- CVE-2020-0072In rw_t2t_handle_tlv_detect_rsp of rw_t2t_ndef.cc, there is a possible out of bounds write due to a missing bounds check.Android
- CVE-2020-0071In rw_t2t_extract_default_locks_info of rw_t2t_ndef.cc, there is a possible out of bounds write due to a missing bounds check.Android
- CVE-2020-0070In rw_t2t_update_lock_attributes of rw_t2t_ndef.cc, there is a possible out of bounds write due to a missing bounds check.Android
- CVE-2020-0079In decrypt_1_2 of CryptoPlugin.cpp, there is a possible out of bounds write due to stale pointer.Android
- CVE-2020-0078In releaseSecureStops of DrmPlugin.cpp, there is a possible out of bounds write due to a missing bounds check.Android
- CVE-2020-0082In ExternalVibration of ExternalVibration.java, there is a possible activation of an arbitrary intent due to unsafe deserialization.Android
- CVE-2020-0081In finalize of AssetManager.java, there is possible memory corruption due to a double free.Android
- CVE-2020-0080In onOpActiveChanged and related methods of AppOpsControllerImpl.java, there is a possible way to display an app overlaying other apps withoAndroid
- CVE-2020-0068In crus_afe_get_param of msm-cirrus-playback.c, there is a possible out of bounds read due to an integer overflow.Android
- CVE-2020-0067In f2fs_xattr_generic_list of xattr.c, there is a possible out of bounds read due to a missing bounds check.Android
- CVE-2020-7079An improper signature validation vulnerability in Autodesk Dynamo BIM versions 2.5.1 and 2.5.0 may lead to code execution through maliciouslAutodesk Dynamo BIM
- CVE-2020-7085A heap overflow vulnerability in the Autodesk FBX-SDK versions 2019.2 and earlier may lead to arbitrary code execution on a system running iAutodesk FBX-SDK
- CVE-2020-7084A NULL pointer dereference vulnerability in the Autodesk FBX-SDK versions 2019.0 and earlier may lead to denial of service of the applicatioAutodesk FBX-SDK
- CVE-2020-7083An intager overflow vulnerability in the Autodesk FBX-SDK versions 2019.0 and earlier may lead to denial of service of the application.Autodesk FBX-SDK
- CVE-2020-7082A use-after-free vulnerability in the Autodesk FBX-SDK versions 2019.0 and earlier may lead to code execution on a system running it.Autodesk FBX-SDK
- CVE-2020-7081A type confusion vulnerability in the Autodesk FBX-SDK versions 2019.0 and earlier may lead to arbitary code read/write on the system runninAutodesk FBX-SDK
- CVE-2020-7080A buffer overflow vulnerability in the Autodesk FBX-SDK versions 2019.0 and earlier may lead to arbitrary code execution on a system runningAutodesk FBX-SDK
- CVE-2019-6203A logic issue was addressed with improved state management.Apple iOS · Apple macOS +1
- CVE-2020-11879An issue was discovered in GNOME Evolution before 3.35.91.
- CVE-2020-11880An issue was discovered in KDE KMail before 19.12.3.
- CVE-2020-11878The Jitsi Meet (aka docker-jitsi-meet) stack on Docker before stable-4384-1 uses default passwords (such as passw0rd) for system accounts.
- CVE-2020-9523Insufficiently protected credentials vulnerability on Micro Focus enterprise developer and enterprise server, affecting all version prior toEnterprise developer and server.
- CVE-2019-12002A remote session reuse vulnerability leading to access restriction bypass was discovered in HPE MSA 2040 SAN Storage; HPE MSA 1040 SAN StoraHPE MSA 2040 SAN Storage; HPE MSA 1040 SAN Storage; HPE MSA…
- CVE-2019-12001A remote session reuse vulnerability leading to access restriction bypass was discovered in HPE MSA 2040 SAN Storage; HPE MSA 1040 SAN StoraHPE MSA 2040 SAN Storage; HPE MSA 1040 SAN Storage; HPE MSA…
- CVE-2019-20785An issue was discovered on LG mobile devices with Android OS 8.0 and 8.1 software for the DTAG carrier.
- CVE-2019-20784An issue was discovered on LG mobile devices with Android OS 7.0, 7.1, 7.2, 8.0, and 8.1 (MTK chipsets) software.
- CVE-2019-20783An issue was discovered on LG mobile devices with Android OS 7.0, 7.1, 7.2, 8.0, and 8.1 (North America CDMA) software.
- CVE-2019-20782An issue was discovered on LG mobile devices with Android OS 7.0, 7.1, 7.2, 8.0, and 8.1 software.
- CVE-2019-20780An issue was discovered on LG mobile devices with Android OS 7.0, 7.1, 7.2, 8.0, and 8.1 software.
- CVE-2019-20779An issue was discovered on LG mobile devices with Android OS 7.0, 7.1, 7.2, 8.0, 8.1, and 9.0 software.
- CVE-2019-20778An issue was discovered on LG mobile devices with Android OS 7.0, 7.1, 7.2, 8.0, 8.1, and 9.0 software.
- CVE-2019-20777An issue was discovered on LG mobile devices with Android OS 7.0, 7.1, 7.2, 8.0, 8.1, and 9.0 software.
- CVE-2019-20776An issue was discovered on LG mobile devices with Android OS 7.0, 7.1, 7.2, 8.0, and 8.1 software.
- CVE-2019-20775An issue was discovered on LG mobile devices with Android OS 9.0 (Qualcomm SDM450, SDM845, SM6150, and SM8150 chipsets) software.
- CVE-2019-20774An issue was discovered on LG mobile devices with Android OS 7.0, 7.1, 7.2, 8.0, 8.1, and 9.0 software.
- CVE-2019-20773An issue was discovered on LG mobile devices with Android OS 7.0, 7.1, 7.2, 8.0, 8.1, and 9.0 software.
- CVE-2019-20772An issue was discovered on LG mobile devices with Android OS 7.0, 7.1, 7.2, 8.0, 8.1, and 9.0 software.
- CVE-2019-20770An issue was discovered on LG mobile devices with Android OS 9.0 software.
- CVE-2019-20769An issue was discovered in LG PC Suite for LG G3 and earlier (aka LG PC Suite v5.3.27 and earlier).
- CVE-2020-11875An issue was discovered on LG mobile devices with Android OS 8.0, 8.1, 9.0, and 10.0 (MTK chipsets) software.
- CVE-2020-4277IBM TRIRIGA Application Platform 3.5.3 and 3.6.1 discloses sensitive information in error messages that could aid an attacker formulate futuIBM TRIRIGA Application Platform
- CVE-2019-4749IBM Maximo Asset Management 7.6 is vulnerable to cross-site scripting.IBM Maximo Asset Management
- CVE-2019-4644IBM Maximo Asset Management 7.6 is vulnerable to cross-site scripting.IBM Maximo Asset Management
- CVE-2019-4446IBM Maximo Asset Management 7.6 could allow an authenticated user perform actions they are not authorized to by modifying request parametersIBM Maximo Asset Management
- CVE-2020-11874An issue was discovered on LG mobile devices with Android OS 8.0, 8.1, 9, and 10 software.
- CVE-2020-11873An issue was discovered on LG mobile devices with Android OS 7.2, 8.0, 8.1, 9, and 10 software.
- CVE-2019-20771An issue was discovered on LG mobile devices with Android OS 7.0, 7.1, 7.2, 8.0, 8.1, and 9.0 software.
- CVE-2020-11793A use-after-free issue exists in WebKitGTK before 2.28.1 and WPE WebKit before 2.28.1 via crafted web content that allows remote attackers t
- CVE-2020-10947Mac Endpoint for Sophos Central before 9.9.6 and Mac Endpoint for Sophos Home before 2.2.6 allow Privilege Escalation.
- CVE-2020-10813A buffer overflow vulnerability in FTPDMIN 0.96 allows attackers to crash the server via a crafted packet.
- CVE-2020-10377A weak encryption vulnerability in Mitel MiVoice Connect Client before 214.100.1214.0 could allow an unauthenticated attacker to gain access
- CVE-2020-10211A remote code execution vulnerability in UCB component of Mitel MiVoice Connect before 19.1 SP1 could allow an unauthenticated remote attack
- CVE-2020-11872The Cloud Functions subsystem in OpenTrace 1.0 might allow fabrication attacks by making billions of TempID requests before an AES-256-GCM k
- CVE-2020-11868ntpd in ntp before 4.2.8p14 and 4.3.x before 4.3.100 allows an off-path attacker to block unauthenticated synchronization via a server mode
- CVE-2019-7306Byobu apport hook uploads user's ~/.screenrcCanonical byobu