# CVEs published 2020-04-17

74 CVEs were published on April 17, 2020: 0 critical, 2 high. Days are UTC.

- [CVE-2020-11887](https://cve.now/CVE-2020-11887.md): svg2png 4.1.1 allows XSS with resultant SSRF via JavaScript inside an SVG document. (no CVSS, svg2png)
- [CVE-2020-11886](https://cve.now/CVE-2020-11886.md): OpenNMS Horizon and Meridian allows HQL Injection in element/nodeList.htm (aka the NodeListController) via snmpParm or snmpParmValue to addC (no CVSS)
- [CVE-2020-11885](https://cve.now/CVE-2020-11885.md): WSO2 Enterprise Integrator through 6.6.0 has an XXE vulnerability where a user (with admin console access) can use the XML validator to make (CVSS 4.0)
- [CVE-2020-11883](https://cve.now/CVE-2020-11883.md): In Divante vue-storefront-api through 1.11.1 and storefront-api through 1.0-rc.1, as used in VueStorefront PWA, unexpected HTTP requests lea (no CVSS, storefront-api · vue-storefront-api)
- [CVE-2020-1751](https://cve.now/CVE-2020-1751.md): An out-of-bounds write vulnerability was found in glibc before 2.31 when handling signal trampolines on PowerPC. (CVSS 5.1, Red Hat glibc)
- [CVE-2020-5731](https://cve.now/CVE-2020-5731.md): In OpenMRS 2.9 and prior, the app parameter for the ActiveVisit's page is vulnerable to cross-site scripting. (no CVSS, OpenMRS)
- [CVE-2020-5730](https://cve.now/CVE-2020-5730.md): In OpenMRS 2.9 and prior, the sessionLocation parameter for the login page is vulnerable to cross-site scripting. (no CVSS, OpenMRS)
- [CVE-2020-5729](https://cve.now/CVE-2020-5729.md): In OpenMRS 2.9 and prior, the UI Framework Error Page reflects arbitrary, user-supplied input back to the browser, which can result in XSS. (no CVSS, OpenMRS)
- [CVE-2020-5728](https://cve.now/CVE-2020-5728.md): OpenMRS 2.9 and prior copies "Referrer" header values into an html element named "redirectUrl" within many webpages (such as login.htm). (no CVSS, OpenMRS)
- [CVE-2020-5733](https://cve.now/CVE-2020-5733.md): In OpenMRS 2.9 and prior, the export functionality of the Data Exchange Module does not properly redirect to a login page when an unauthenti (no CVSS, OpenMRS)
- [CVE-2020-5732](https://cve.now/CVE-2020-5732.md): In OpenMRS 2.9 and prior, he import functionality of the Data Exchange Module does not properly redirect to a login page when an unauthentic (no CVSS, OpenMRS)
- [CVE-2020-5737](https://cve.now/CVE-2020-5737.md): Stored XSS in Tenable.Sc before 5.14.0 could allow an authenticated remote attacker to craft a request to execute arbitrary script code in a (no CVSS, Tenable.Sc)
- [CVE-2020-0077](https://cve.now/CVE-2020-0077.md): In authorize\_enroll of the FPC IRIS TrustZone app, there is a possible out of bounds read due to a missing bounds check. (no CVSS, Android)
- [CVE-2020-0075](https://cve.now/CVE-2020-0075.md): In set\_shared\_key of the FPC IRIS TrustZone app, there is a possible out of bounds read due to a missing bounds check. (no CVSS, Android)
- [CVE-2020-0076](https://cve.now/CVE-2020-0076.md): In get\_auth\_result of the FPC IRIS TrustZone app, there is a possible out of bounds write due to a missing bounds check. (no CVSS, Android)
- [CVE-2019-2056](https://cve.now/CVE-2019-2056.md): There is a possible disclosure of RAM using a shared crypto key due to improperly used crypto. (no CVSS, Android)
- [CVE-2020-0073](https://cve.now/CVE-2020-0073.md): In rw\_t2t\_handle\_tlv\_detect\_rsp of rw\_t2t\_ndef.cc, there is a possible out of bounds write due to a missing bounds check. (no CVSS, Android)
- [CVE-2020-0072](https://cve.now/CVE-2020-0072.md): In rw\_t2t\_handle\_tlv\_detect\_rsp of rw\_t2t\_ndef.cc, there is a possible out of bounds write due to a missing bounds check. (no CVSS, Android)
- [CVE-2020-0071](https://cve.now/CVE-2020-0071.md): In rw\_t2t\_extract\_default\_locks\_info of rw\_t2t\_ndef.cc, there is a possible out of bounds write due to a missing bounds check. (no CVSS, Android)
- [CVE-2020-0070](https://cve.now/CVE-2020-0070.md): In rw\_t2t\_update\_lock\_attributes of rw\_t2t\_ndef.cc, there is a possible out of bounds write due to a missing bounds check. (no CVSS, Android)
- [CVE-2020-0079](https://cve.now/CVE-2020-0079.md): In decrypt\_1\_2 of CryptoPlugin.cpp, there is a possible out of bounds write due to stale pointer. (no CVSS, Android)
- [CVE-2020-0078](https://cve.now/CVE-2020-0078.md): In releaseSecureStops of DrmPlugin.cpp, there is a possible out of bounds write due to a missing bounds check. (no CVSS, Android)
- [CVE-2020-0082](https://cve.now/CVE-2020-0082.md): In ExternalVibration of ExternalVibration.java, there is a possible activation of an arbitrary intent due to unsafe deserialization. (no CVSS, Android)
- [CVE-2020-0081](https://cve.now/CVE-2020-0081.md): In finalize of AssetManager.java, there is possible memory corruption due to a double free. (no CVSS, Android)
- [CVE-2020-0080](https://cve.now/CVE-2020-0080.md): In onOpActiveChanged and related methods of AppOpsControllerImpl.java, there is a possible way to display an app overlaying other apps witho (no CVSS, Android)
- [CVE-2020-0068](https://cve.now/CVE-2020-0068.md): In crus\_afe\_get\_param of msm-cirrus-playback.c, there is a possible out of bounds read due to an integer overflow. (no CVSS, Android)
- [CVE-2020-0067](https://cve.now/CVE-2020-0067.md): In f2fs\_xattr\_generic\_list of xattr.c, there is a possible out of bounds read due to a missing bounds check. (no CVSS, Android)
- [CVE-2020-7079](https://cve.now/CVE-2020-7079.md): An improper signature validation vulnerability in Autodesk Dynamo BIM versions 2.5.1 and 2.5.0 may lead to code execution through maliciousl (no CVSS, Autodesk Dynamo BIM)
- [CVE-2020-7085](https://cve.now/CVE-2020-7085.md): A heap overflow vulnerability in the Autodesk FBX-SDK versions 2019.2 and earlier may lead to arbitrary code execution on a system running i (no CVSS, Autodesk FBX-SDK)
- [CVE-2020-7084](https://cve.now/CVE-2020-7084.md): A NULL pointer dereference vulnerability in the Autodesk FBX-SDK versions 2019.0 and earlier may lead to denial of service of the applicatio (no CVSS, Autodesk FBX-SDK)
- [CVE-2020-7083](https://cve.now/CVE-2020-7083.md): An intager overflow vulnerability in the Autodesk FBX-SDK versions 2019.0 and earlier may lead to denial of service of the application. (no CVSS, Autodesk FBX-SDK)
- [CVE-2020-7082](https://cve.now/CVE-2020-7082.md): A use-after-free vulnerability in the Autodesk FBX-SDK versions 2019.0 and earlier may lead to code execution on a system running it. (no CVSS, Autodesk FBX-SDK)
- [CVE-2020-7081](https://cve.now/CVE-2020-7081.md): A type confusion vulnerability in the Autodesk FBX-SDK versions 2019.0 and earlier may lead to arbitary code read/write on the system runnin (no CVSS, Autodesk FBX-SDK)
- [CVE-2020-7080](https://cve.now/CVE-2020-7080.md): A buffer overflow vulnerability in the Autodesk FBX-SDK versions 2019.0 and earlier may lead to arbitrary code execution on a system running (no CVSS, Autodesk FBX-SDK)
- [CVE-2019-6203](https://cve.now/CVE-2019-6203.md): A logic issue was addressed with improved state management. (no CVSS, Apple iOS · Apple macOS +1)
- [CVE-2020-11879](https://cve.now/CVE-2020-11879.md): An issue was discovered in GNOME Evolution before 3.35.91. (no CVSS)
- [CVE-2020-11880](https://cve.now/CVE-2020-11880.md): An issue was discovered in KDE KMail before 19.12.3. (no CVSS)
- [CVE-2020-11878](https://cve.now/CVE-2020-11878.md): The Jitsi Meet (aka docker-jitsi-meet) stack on Docker before stable-4384-1 uses default passwords (such as passw0rd) for system accounts. (no CVSS)
- [CVE-2020-11876](https://cve.now/CVE-2020-11876.md): airhost.exe in Zoom Client for Meetings 4.6.11 uses the SHA-256 hash of 0123425234234fsdfsdr3242 for initialization of an OpenSSL EVP AES-25 (CVSS 7.5)
- [CVE-2020-11877](https://cve.now/CVE-2020-11877.md): airhost.exe in Zoom Client for Meetings 4.6.11 uses 3423423432325249 as the Initialization Vector (IV) for AES-256 CBC encryption. (CVSS 7.5)
- [CVE-2020-9523](https://cve.now/CVE-2020-9523.md): Insufficiently protected credentials vulnerability on Micro Focus enterprise developer and enterprise server, affecting all version prior to (no CVSS, Enterprise developer and server.)
- [CVE-2019-12002](https://cve.now/CVE-2019-12002.md): A remote session reuse vulnerability leading to access restriction bypass was discovered in HPE MSA 2040 SAN Storage; HPE MSA 1040 SAN Stora (no CVSS, HPE MSA 2040 SAN Storage; HPE MSA 1040 SAN Storage; HPE MSA…)
- [CVE-2019-12001](https://cve.now/CVE-2019-12001.md): A remote session reuse vulnerability leading to access restriction bypass was discovered in HPE MSA 2040 SAN Storage; HPE MSA 1040 SAN Stora (no CVSS, HPE MSA 2040 SAN Storage; HPE MSA 1040 SAN Storage; HPE MSA…)
- [CVE-2019-20785](https://cve.now/CVE-2019-20785.md): An issue was discovered on LG mobile devices with Android OS 8.0 and 8.1 software for the DTAG carrier. (no CVSS)
- [CVE-2019-20784](https://cve.now/CVE-2019-20784.md): An issue was discovered on LG mobile devices with Android OS 7.0, 7.1, 7.2, 8.0, and 8.1 (MTK chipsets) software. (no CVSS)
- [CVE-2019-20783](https://cve.now/CVE-2019-20783.md): An issue was discovered on LG mobile devices with Android OS 7.0, 7.1, 7.2, 8.0, and 8.1 (North America CDMA) software. (no CVSS)
- [CVE-2019-20782](https://cve.now/CVE-2019-20782.md): An issue was discovered on LG mobile devices with Android OS 7.0, 7.1, 7.2, 8.0, and 8.1 software. (no CVSS)
- [CVE-2019-20780](https://cve.now/CVE-2019-20780.md): An issue was discovered on LG mobile devices with Android OS 7.0, 7.1, 7.2, 8.0, and 8.1 software. (no CVSS)
- [CVE-2019-20779](https://cve.now/CVE-2019-20779.md): An issue was discovered on LG mobile devices with Android OS 7.0, 7.1, 7.2, 8.0, 8.1, and 9.0 software. (no CVSS)
- [CVE-2019-20778](https://cve.now/CVE-2019-20778.md): An issue was discovered on LG mobile devices with Android OS 7.0, 7.1, 7.2, 8.0, 8.1, and 9.0 software. (no CVSS)
- [CVE-2019-20777](https://cve.now/CVE-2019-20777.md): An issue was discovered on LG mobile devices with Android OS 7.0, 7.1, 7.2, 8.0, 8.1, and 9.0 software. (no CVSS)
- [CVE-2019-20776](https://cve.now/CVE-2019-20776.md): An issue was discovered on LG mobile devices with Android OS 7.0, 7.1, 7.2, 8.0, and 8.1 software. (no CVSS)
- [CVE-2019-20775](https://cve.now/CVE-2019-20775.md): An issue was discovered on LG mobile devices with Android OS 9.0 (Qualcomm SDM450, SDM845, SM6150, and SM8150 chipsets) software. (no CVSS)
- [CVE-2019-20774](https://cve.now/CVE-2019-20774.md): An issue was discovered on LG mobile devices with Android OS 7.0, 7.1, 7.2, 8.0, 8.1, and 9.0 software. (no CVSS)
- [CVE-2019-20773](https://cve.now/CVE-2019-20773.md): An issue was discovered on LG mobile devices with Android OS 7.0, 7.1, 7.2, 8.0, 8.1, and 9.0 software. (no CVSS)
- [CVE-2019-20772](https://cve.now/CVE-2019-20772.md): An issue was discovered on LG mobile devices with Android OS 7.0, 7.1, 7.2, 8.0, 8.1, and 9.0 software. (no CVSS)
- [CVE-2019-20770](https://cve.now/CVE-2019-20770.md): An issue was discovered on LG mobile devices with Android OS 9.0 software. (no CVSS)
- [CVE-2019-20769](https://cve.now/CVE-2019-20769.md): An issue was discovered in LG PC Suite for LG G3 and earlier (aka LG PC Suite v5.3.27 and earlier). (no CVSS)
- [CVE-2020-11875](https://cve.now/CVE-2020-11875.md): An issue was discovered on LG mobile devices with Android OS 8.0, 8.1, 9.0, and 10.0 (MTK chipsets) software. (no CVSS)
- [CVE-2020-4277](https://cve.now/CVE-2020-4277.md): IBM TRIRIGA Application Platform 3.5.3 and 3.6.1 discloses sensitive information in error messages that could aid an attacker formulate futu (CVSS 5.3, IBM TRIRIGA Application Platform)
- [CVE-2019-4749](https://cve.now/CVE-2019-4749.md): IBM Maximo Asset Management 7.6 is vulnerable to cross-site scripting. (CVSS 5.4, IBM Maximo Asset Management)
- [CVE-2019-4644](https://cve.now/CVE-2019-4644.md): IBM Maximo Asset Management 7.6 is vulnerable to cross-site scripting. (CVSS 6.1, IBM Maximo Asset Management)
- [CVE-2019-4446](https://cve.now/CVE-2019-4446.md): IBM Maximo Asset Management 7.6 could allow an authenticated user perform actions they are not authorized to by modifying request parameters (CVSS 5.4, IBM Maximo Asset Management)
- [CVE-2020-11874](https://cve.now/CVE-2020-11874.md): An issue was discovered on LG mobile devices with Android OS 8.0, 8.1, 9, and 10 software. (no CVSS)
- [CVE-2020-11873](https://cve.now/CVE-2020-11873.md): An issue was discovered on LG mobile devices with Android OS 7.2, 8.0, 8.1, 9, and 10 software. (no CVSS)
- [CVE-2019-20771](https://cve.now/CVE-2019-20771.md): An issue was discovered on LG mobile devices with Android OS 7.0, 7.1, 7.2, 8.0, 8.1, and 9.0 software. (no CVSS)
- [CVE-2020-11793](https://cve.now/CVE-2020-11793.md): A use-after-free issue exists in WebKitGTK before 2.28.1 and WPE WebKit before 2.28.1 via crafted web content that allows remote attackers t (no CVSS)
- [CVE-2020-10947](https://cve.now/CVE-2020-10947.md): Mac Endpoint for Sophos Central before 9.9.6 and Mac Endpoint for Sophos Home before 2.2.6 allow Privilege Escalation. (no CVSS)
- [CVE-2020-10813](https://cve.now/CVE-2020-10813.md): A buffer overflow vulnerability in FTPDMIN 0.96 allows attackers to crash the server via a crafted packet. (no CVSS)
- [CVE-2020-10377](https://cve.now/CVE-2020-10377.md): A weak encryption vulnerability in Mitel MiVoice Connect Client before 214.100.1214.0 could allow an unauthenticated attacker to gain access (no CVSS)
- [CVE-2020-10211](https://cve.now/CVE-2020-10211.md): A remote code execution vulnerability in UCB component of Mitel MiVoice Connect before 19.1 SP1 could allow an unauthenticated remote attack (no CVSS)
- [CVE-2020-11872](https://cve.now/CVE-2020-11872.md): The Cloud Functions subsystem in OpenTrace 1.0 might allow fabrication attacks by making billions of TempID requests before an AES-256-GCM k (no CVSS)
- [CVE-2020-11868](https://cve.now/CVE-2020-11868.md): ntpd in ntp before 4.2.8p14 and 4.3.x before 4.3.100 allows an off-path attacker to block unauthenticated synchronization via a server mode (CVSS 5.9)
- [CVE-2019-7306](https://cve.now/CVE-2019-7306.md): Byobu apport hook uploads user's ~/.screenrc (CVSS 4.3, Canonical byobu)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2020-04-17
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.