# CVEs published 2020-04-20 64 CVEs were published on April 20, 2020: 1 critical, 16 high. Days are UTC. - [CVE-2020-9279](https://cve.now/CVE-2020-9279.md): An issue was discovered on D-Link DSL-2640B B2 EU\_4.01B devices. (no CVSS) - [CVE-2020-9278](https://cve.now/CVE-2020-9278.md): An issue was discovered on D-Link DSL-2640B B2 EU\_4.01B devices. (no CVSS) - [CVE-2020-9277](https://cve.now/CVE-2020-9277.md): An issue was discovered on D-Link DSL-2640B B2 EU\_4.01B devices. (no CVSS) - [CVE-2020-9276](https://cve.now/CVE-2020-9276.md): An issue was discovered on D-Link DSL-2640B B2 EU\_4.01B devices. (no CVSS) - [CVE-2020-9275](https://cve.now/CVE-2020-9275.md): An issue was discovered on D-Link DSL-2640B B2 EU\_4.01B devices. (no CVSS) - [CVE-2020-11010](https://cve.now/CVE-2020-11010.md): SQL injection in Tortoise ORM (CVSS 6.3, tortoise-orm) - [CVE-2020-11944](https://cve.now/CVE-2020-11944.md): Abe (aka bitcoin-abe) through 0.7.2, and 0.8pre, allows XSS in \_\_call\_\_ in abe.py because the PATH\_INFO environment variable is mishandled d (no CVSS) - [CVE-2019-19108](https://cve.now/CVE-2019-19108.md): B&R Automation Runtime SNMP Authentication and Authorization Weakness (CVSS 9.4, B&R Automation Runtime) - [CVE-2020-11946](https://cve.now/CVE-2020-11946.md): Zoho ManageEngine OpManager before 125120 allows an unauthenticated user to retrieve an API key via a servlet call. (no CVSS) - [CVE-2020-9445](https://cve.now/CVE-2020-9445.md): Zulip Server before 2.1.3 allows XSS via the modal\_link feature in the Markdown functionality. (no CVSS) - [CVE-2020-9444](https://cve.now/CVE-2020-9444.md): Zulip Server before 2.1.3 allows reverse tabnabbing via the Markdown functionality. (no CVSS) - [CVE-2020-10935](https://cve.now/CVE-2020-10935.md): Zulip Server before 2.1.3 allows XSS via a Markdown link, with resultant account takeover. (no CVSS) - [CVE-2020-1803](https://cve.now/CVE-2020-1803.md): Huawei smartphones Honor V20 with versions earlier than 10.0.0.179(C636E3R4P3),versions earlier than 10.0.0.180(C185E3R3P3),versions earlier (no CVSS, Huawei Honor) - [CVE-2020-9070](https://cve.now/CVE-2020-9070.md): Huawei smartphones Taurus-AL00B with versions earlier than 10.0.0.205(C00E201R7P2) have an improper authentication vulnerability. (no CVSS, Huawei Taurus-AL00B) - [CVE-2020-3946](https://cve.now/CVE-2020-3946.md): InstallBuilder AutoUpdate tool and regular installers enabling \ built with versions earlier than 19.11 are vulnerable to Bi (no CVSS, VMware InstallBuilder) - [CVE-2020-11753](https://cve.now/CVE-2020-11753.md): An issue was discovered in Sonatype Nexus Repository Manager in versions 3.21.1 and 3.22.0. (no CVSS) - [CVE-2020-5286](https://cve.now/CVE-2020-5286.md): Reflected XSS related in import page in PrestaShop (CVSS 4.1, PrestaShop) - [CVE-2020-5287](https://cve.now/CVE-2020-5287.md): Improper access control on customers search in PrestaShop (CVSS 4.1, PrestaShop) - [CVE-2020-5288](https://cve.now/CVE-2020-5288.md): Improper access control on product attributes page in PrestaShop (CVSS 4.1, PrestaShop) - [CVE-2020-5293](https://cve.now/CVE-2020-5293.md): Improper access control on product page with combinations, attachments and specific prices in PrestaShop (CVSS 6.5, PrestaShop) - [CVE-2020-5271](https://cve.now/CVE-2020-5271.md): Reflected XSS with dashboard calendar of PrestaShop (CVSS 4.1, PrestaShop) - [CVE-2020-5272](https://cve.now/CVE-2020-5272.md): Reflected XSS on Search page of PrestaShop (CVSS 4.1, PrestaShop) - [CVE-2020-5276](https://cve.now/CVE-2020-5276.md): Reflected XSS on AdminCarts page of PrestaShop (CVSS 4.1, PrestaShop) - [CVE-2020-5278](https://cve.now/CVE-2020-5278.md): Reflected XSS on Exception page of PrestaShop (CVSS 4.1, PrestaShop) - [CVE-2020-5279](https://cve.now/CVE-2020-5279.md): Improper Access Control for certain legacy controller in PrestaShop (CVSS 4.1, PrestaShop) - [CVE-2020-5285](https://cve.now/CVE-2020-5285.md): Reflected XSS with back parameter in PrestaShop (CVSS 4.1, PrestaShop) - [CVE-2020-5269](https://cve.now/CVE-2020-5269.md): Reflected XSS on AdminFeatures page of PrestaShop (CVSS 4.1, PrestaShop) - [CVE-2020-5270](https://cve.now/CVE-2020-5270.md): Open redirection when using back parameter of PrestaShop (CVSS 4.1, PrestaShop) - [CVE-2017-18822](https://cve.now/CVE-2017-18822.md): Certain NETGEAR devices are affected by vertical privilege escalation. (CVSS 7.8) - [CVE-2017-18823](https://cve.now/CVE-2017-18823.md): Certain NETGEAR devices are affected by incorrect configuration of security settings. (CVSS 7.7) - [CVE-2017-18824](https://cve.now/CVE-2017-18824.md): Certain NETGEAR devices are affected by directory traversal. (CVSS 4.0) - [CVE-2017-18825](https://cve.now/CVE-2017-18825.md): Certain NETGEAR devices are affected by stored XSS. (CVSS 5.2) - [CVE-2017-18826](https://cve.now/CVE-2017-18826.md): Certain NETGEAR devices are affected by vertical privilege escalation. (CVSS 7.8) - [CVE-2020-5264](https://cve.now/CVE-2020-5264.md): Reflected XSS in security compromised page of PrestaShop (CVSS 4.4, PrestaShop) - [CVE-2020-5265](https://cve.now/CVE-2020-5265.md): Reflected XSS on AdminAttributesGroups page of PrestaShop (CVSS 4.4, PrestaShop) - [CVE-2017-18827](https://cve.now/CVE-2017-18827.md): Certain NETGEAR devices are affected by stored XSS. (CVSS 5.2) - [CVE-2017-18828](https://cve.now/CVE-2017-18828.md): Certain NETGEAR devices are affected by stored XSS. (CVSS 5.2) - [CVE-2017-18829](https://cve.now/CVE-2017-18829.md): Certain NETGEAR devices are affected by vertical privilege escalation. (CVSS 7.8) - [CVE-2017-18830](https://cve.now/CVE-2017-18830.md): Certain NETGEAR devices are affected by vertical privilege escalation. (CVSS 7.8) - [CVE-2017-18831](https://cve.now/CVE-2017-18831.md): Certain NETGEAR devices are affected by stored XSS. (CVSS 7.8) - [CVE-2017-18832](https://cve.now/CVE-2017-18832.md): Certain NETGEAR devices are affected by stored XSS. (CVSS 5.2) - [CVE-2017-18833](https://cve.now/CVE-2017-18833.md): Certain NETGEAR devices are affected by reflected XSS. (CVSS 6.1) - [CVE-2017-18834](https://cve.now/CVE-2017-18834.md): Certain NETGEAR devices are affected by reflected XSS. (CVSS 6.1) - [CVE-2017-18835](https://cve.now/CVE-2017-18835.md): Certain NETGEAR devices are affected by reflected XSS. (CVSS 6.1) - [CVE-2017-18836](https://cve.now/CVE-2017-18836.md): Certain NETGEAR devices are affected by denial of service. (CVSS 6.2) - [CVE-2017-18837](https://cve.now/CVE-2017-18837.md): Certain NETGEAR devices are affected by vertical privilege escalation. (CVSS 7.8) - [CVE-2017-18838](https://cve.now/CVE-2017-18838.md): Certain NETGEAR devices are affected by privilege escalation. (CVSS 7.8) - [CVE-2017-18839](https://cve.now/CVE-2017-18839.md): Certain NETGEAR devices are affected by stored XSS. (CVSS 5.2) - [CVE-2017-18840](https://cve.now/CVE-2017-18840.md): Certain NETGEAR devices are affected by denial of service. (CVSS 6.2) - [CVE-2017-18841](https://cve.now/CVE-2017-18841.md): Certain NETGEAR devices are affected by command injection. (CVSS 6.7) - [CVE-2020-11888](https://cve.now/CVE-2020-11888.md): python-markdown2 through 2.3.8 allows XSS because element names are mishandled unless a \\w+ match succeeds. (no CVSS, markdown2) - [CVE-2017-18842](https://cve.now/CVE-2017-18842.md): Certain NETGEAR devices are affected by CSRF. (CVSS 8.8) - [CVE-2017-18843](https://cve.now/CVE-2017-18843.md): Certain NETGEAR devices are affected by disclosure of administrative credentials. (CVSS 8.4) - [CVE-2017-18844](https://cve.now/CVE-2017-18844.md): Certain NETGEAR devices are affected by disclosure of administrative credentials. (CVSS 8.4) - [CVE-2017-18845](https://cve.now/CVE-2017-18845.md): Certain NETGEAR devices are affected by disclosure of administrative credentials. (CVSS 8.4) - [CVE-2017-18846](https://cve.now/CVE-2017-18846.md): Certain NETGEAR devices are affected by a stack-based buffer overflow. (CVSS 6.7) - [CVE-2017-18847](https://cve.now/CVE-2017-18847.md): Certain NETGEAR devices are affected by an attacker's ability to read arbitrary files. (CVSS 6.2) - [CVE-2017-18848](https://cve.now/CVE-2017-18848.md): Certain NETGEAR devices are affected by CSRF. (CVSS 8.8) - [CVE-2017-18849](https://cve.now/CVE-2017-18849.md): Certain NETGEAR devices are affected by command injection. (CVSS 8.4) - [CVE-2017-18850](https://cve.now/CVE-2017-18850.md): Certain NETGEAR devices are affected by authentication bypass. (CVSS 8.4) - [CVE-2017-18851](https://cve.now/CVE-2017-18851.md): Certain NETGEAR devices are affected by command injection by an authenticated user. (CVSS 6.7) - [CVE-2017-18852](https://cve.now/CVE-2017-18852.md): Certain NETGEAR devices are affected by CSRF and authentication bypass. (CVSS 8.4) - [CVE-2020-5569](https://cve.now/CVE-2020-5569.md): An unquoted search path vulnerability exists in HDD Password tool (for Windows) version 1.20.6620 and earlier which is stored in CANVIO PREM (no CVSS, Toshiba Electronic Devices & Storage HDD Password tool) - [CVE-2020-11930](https://cve.now/CVE-2020-11930.md): The GTranslate plugin before 2.8.52 for WordPress has Reflected XSS via a crafted link. (no CVSS) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2020-04-20 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.