CVEs published April 20, 2020
64 CVEs were published on April 20, 2020: 1 critical, 16 high.
- Published
- 64
- Critical
- 1
- High
- 16
- Medium
- 30
- Low
- 0
- Unrated
- 17
- Now in CISA KEV
- 0
- Fix available
- 16
Most affected products
- PrestaShop
- 14
- B&R Automation Runtime
- 1
- Huawei Honor
- 1
- Huawei Taurus-AL00B
- 1
- markdown2
- 1
- tortoise-orm
- 1
- Toshiba Electronic Devices & Storage HDD Password tool
- 1
- VMware InstallBuilder
- 1
Critical 1
High 16
- CVE-2017-18822Certain NETGEAR devices are affected by vertical privilege escalation.
- CVE-2017-18823Certain NETGEAR devices are affected by incorrect configuration of security settings.
- CVE-2017-18826Certain NETGEAR devices are affected by vertical privilege escalation.
- CVE-2017-18829Certain NETGEAR devices are affected by vertical privilege escalation.
- CVE-2017-18830Certain NETGEAR devices are affected by vertical privilege escalation.
- CVE-2017-18831Certain NETGEAR devices are affected by stored XSS.
- CVE-2017-18837Certain NETGEAR devices are affected by vertical privilege escalation.
- CVE-2017-18838Certain NETGEAR devices are affected by privilege escalation.
- CVE-2017-18842Certain NETGEAR devices are affected by CSRF.
- CVE-2017-18843Certain NETGEAR devices are affected by disclosure of administrative credentials.
- CVE-2017-18844Certain NETGEAR devices are affected by disclosure of administrative credentials.
- CVE-2017-18845Certain NETGEAR devices are affected by disclosure of administrative credentials.
- CVE-2017-18848Certain NETGEAR devices are affected by CSRF.
- CVE-2017-18849Certain NETGEAR devices are affected by command injection.
- CVE-2017-18850Certain NETGEAR devices are affected by authentication bypass.
- CVE-2017-18852Certain NETGEAR devices are affected by CSRF and authentication bypass.
Medium, low and unrated 47
- CVE-2020-9279An issue was discovered on D-Link DSL-2640B B2 EU_4.01B devices.
- CVE-2020-9278An issue was discovered on D-Link DSL-2640B B2 EU_4.01B devices.
- CVE-2020-9277An issue was discovered on D-Link DSL-2640B B2 EU_4.01B devices.
- CVE-2020-9276An issue was discovered on D-Link DSL-2640B B2 EU_4.01B devices.
- CVE-2020-9275An issue was discovered on D-Link DSL-2640B B2 EU_4.01B devices.
- CVE-2020-11010SQL injection in Tortoise ORMtortoise-orm
- CVE-2020-11944Abe (aka bitcoin-abe) through 0.7.2, and 0.8pre, allows XSS in __call__ in abe.py because the PATH_INFO environment variable is mishandled d
- CVE-2020-11946Zoho ManageEngine OpManager before 125120 allows an unauthenticated user to retrieve an API key via a servlet call.
- CVE-2020-9445Zulip Server before 2.1.3 allows XSS via the modal_link feature in the Markdown functionality.
- CVE-2020-9444Zulip Server before 2.1.3 allows reverse tabnabbing via the Markdown functionality.
- CVE-2020-10935Zulip Server before 2.1.3 allows XSS via a Markdown link, with resultant account takeover.
- CVE-2020-1803Huawei smartphones Honor V20 with versions earlier than 10.0.0.179(C636E3R4P3),versions earlier than 10.0.0.180(C185E3R3P3),versions earlierHuawei Honor
- CVE-2020-9070Huawei smartphones Taurus-AL00B with versions earlier than 10.0.0.205(C00E201R7P2) have an improper authentication vulnerability.Huawei Taurus-AL00B
- CVE-2020-3946InstallBuilder AutoUpdate tool and regular installers enabling <checkForUpdates> built with versions earlier than 19.11 are vulnerable to BiVMware InstallBuilder
- CVE-2020-11753An issue was discovered in Sonatype Nexus Repository Manager in versions 3.21.1 and 3.22.0.
- CVE-2020-5286Reflected XSS related in import page in PrestaShopPrestaShop
- CVE-2020-5287Improper access control on customers search in PrestaShopPrestaShop
- CVE-2020-5288Improper access control on product attributes page in PrestaShopPrestaShop
- CVE-2020-5293Improper access control on product page with combinations, attachments and specific prices in PrestaShopPrestaShop
- CVE-2020-5271Reflected XSS with dashboard calendar of PrestaShopPrestaShop
- CVE-2020-5272Reflected XSS on Search page of PrestaShopPrestaShop
- CVE-2020-5276Reflected XSS on AdminCarts page of PrestaShopPrestaShop
- CVE-2020-5278Reflected XSS on Exception page of PrestaShopPrestaShop
- CVE-2020-5279Improper Access Control for certain legacy controller in PrestaShopPrestaShop
- CVE-2020-5285Reflected XSS with back parameter in PrestaShopPrestaShop
- CVE-2020-5269Reflected XSS on AdminFeatures page of PrestaShopPrestaShop
- CVE-2020-5270Open redirection when using back parameter of PrestaShopPrestaShop
- CVE-2017-18824Certain NETGEAR devices are affected by directory traversal.
- CVE-2017-18825Certain NETGEAR devices are affected by stored XSS.
- CVE-2020-5264Reflected XSS in security compromised page of PrestaShopPrestaShop
- CVE-2020-5265Reflected XSS on AdminAttributesGroups page of PrestaShopPrestaShop
- CVE-2017-18827Certain NETGEAR devices are affected by stored XSS.
- CVE-2017-18828Certain NETGEAR devices are affected by stored XSS.
- CVE-2017-18832Certain NETGEAR devices are affected by stored XSS.
- CVE-2017-18833Certain NETGEAR devices are affected by reflected XSS.
- CVE-2017-18834Certain NETGEAR devices are affected by reflected XSS.
- CVE-2017-18835Certain NETGEAR devices are affected by reflected XSS.
- CVE-2017-18836Certain NETGEAR devices are affected by denial of service.
- CVE-2017-18839Certain NETGEAR devices are affected by stored XSS.
- CVE-2017-18840Certain NETGEAR devices are affected by denial of service.
- CVE-2017-18841Certain NETGEAR devices are affected by command injection.
- CVE-2020-11888python-markdown2 through 2.3.8 allows XSS because element names are mishandled unless a \w+ match succeeds.markdown2
- CVE-2017-18846Certain NETGEAR devices are affected by a stack-based buffer overflow.
- CVE-2017-18847Certain NETGEAR devices are affected by an attacker's ability to read arbitrary files.
- CVE-2017-18851Certain NETGEAR devices are affected by command injection by an authenticated user.
- CVE-2020-5569An unquoted search path vulnerability exists in HDD Password tool (for Windows) version 1.20.6620 and earlier which is stored in CANVIO PREMToshiba Electronic Devices & Storage HDD Password tool
- CVE-2020-11930The GTranslate plugin before 2.8.52 for WordPress has Reflected XSS via a crafted link.