CVEs published April 21, 2020
65 CVEs were published on April 21, 2020: 0 critical, 10 high.
- Published
- 65
- Critical
- 0
- High
- 10
- Medium
- 34
- Low
- 1
- Unrated
- 20
- Now in CISA KEV
- 0
- Fix available
- 7
Most affected products
- "HCL AppScan Enterprise Edition"
- 1
- Bitdefender Antivirus Free
- 1
- git
- 1
- Google Earth Pro
- 1
- OpenSSL · openssl-src
- 1
- Oppo Color OS
- 1
- Red Hat undertow · io.undertow:undertow-core
- 1
- simplesamlphp · simplesamlphp/simplesamlphp
- 1
- Sustainsys Saml2 · Sustainsys.Saml2
- 1
- The Ceph Project ceph
- 1
High 10
- CVE-2018-21140Certain NETGEAR devices are affected by incorrect configuration of security settings.
- CVE-2017-18791Certain NETGEAR devices are affected by CSRF.
- CVE-2017-18792NETGEAR D6100 devices before 1.0.0.50_0.0.50 are affected by command injection.
- CVE-2017-18794Certain NETGEAR devices are affected by command injection.
- CVE-2017-18798Certain NETGEAR devices are affected by incorrect configuration of security settings.
- CVE-2017-18799Certain NETGEAR devices are affected by incorrect configuration of security settings.
- CVE-2020-8895DLL Hijacking in Google Earth Pro Windows installerGoogle Earth Pro
- CVE-2020-1757A flaw was found in all undertow-2.x.x SP1 versions prior to undertow-2.0.30.SP1, all undertow-1.x.x and undertow-2.x.x versions prior to unRed Hat undertow · io.undertow:undertow-core
- CVE-2020-1699A path traversal flaw was found in the Ceph dashboard implemented in upstream versions v14.2.5, v14.2.6, v15.0.0 of Ceph storage and has beeThe Ceph Project ceph
- CVE-2020-8099Link Resolution Privilege Escalation Vulnerability in Bitdefender Antivirus Free (VA-8387)Bitdefender Antivirus Free
Medium, low and unrated 55
- CVE-2020-12051The CentralAuth extension through REL1_34 for MediaWiki allows remote attackers to obtain sensitive hidden account information via an api.ph
- CVE-2018-21148Certain NETGEAR devices are affected by a stack-based buffer overflow by an authenticated user.
- CVE-2018-21147Certain NETGEAR devices are affected by a stack-based buffer overflow by an authenticated user.
- CVE-2018-21146Certain NETGEAR devices are affected by command injection by an authenticated user.
- CVE-2018-21145Certain NETGEAR devices are affected by a stack-based buffer overflow by an authenticated user.
- CVE-2018-21144Certain NETGEAR devices are affected by a stack-based buffer overflow by an authenticated user.
- CVE-2018-21143NETGEAR GS810EMX devices before 1.0.0.5 are affected by disclosure of sensitive information.
- CVE-2018-21141Certain NETGEAR devices are affected by denial of service.
- CVE-2020-5301Information disclosure of source code in SimpleSAMLphpsimplesamlphp · simplesamlphp/simplesamlphp
- CVE-2020-10569SysAid On-Premise 20.1.11, by default, allows the AJP protocol port, which is vulnerable to a GhostCat attack.
- CVE-2019-17525The login page on D-Link DIR-615 T1 20.10 devices allows remote attackers to bypass the CAPTCHA protection mechanism and conduct brute-force
- CVE-2017-18790Certain NETGEAR devices are affected by disclosure of sensitive information.
- CVE-2017-18793NETGEAR R7800 devices before 1.0.2.36 are affected by command injection.
- CVE-2020-11008Malicious URLs can still cause Git to send a stored credential to the wrong servergit
- CVE-2017-18795Certain NETGEAR devices are affected by command injection.
- CVE-2017-18796Certain NETGEAR devices are affected by command injection.
- CVE-2017-18797Certain NETGEAR devices are affected by an attacker's ability to read arbitrary files.
- CVE-2017-18800Certain NETGEAR devices are affected by reflected XSS.
- CVE-2017-18801Certain NETGEAR devices are affected by command injection.
- CVE-2019-4327"HCL AppScan Enterprise uses hard-coded credentials which can be exploited by attackers to get unauthorized access to application's encrypte"HCL AppScan Enterprise Edition"
- CVE-2017-18802Certain NETGEAR devices are affected by command injection.
- CVE-2017-18803NETGEAR R7800 devices before 1.0.2.30 are affected by incorrect configuration of security settings.
- CVE-2017-18804Certain NETGEAR devices are affected by command injection.
- CVE-2017-18805Certain NETGEAR devices are affected by command injection.
- CVE-2020-10787An elevation of privilege in Vesta Control Panel through 0.9.8-26 allows an attacker to gain root system access from the admin account via v
- CVE-2020-10786A remote command execution in Vesta Control Panel through 0.9.8-26 allows any authenticated user to execute arbitrary commands on the system
- CVE-2020-11891An issue was discovered in Joomla! before 3.9.17.
- CVE-2020-11889An issue was discovered in Joomla! before 3.9.17.
- CVE-2020-11890An issue was discovered in Joomla! before 3.9.17.
- CVE-2017-18806Certain NETGEAR devices are affected by command injection.
- CVE-2017-18807NETGEAR ReadyNAS OS 6 devices running ReadyNAS OS versions prior to 6.8.0 are affected by stored XSS.
- CVE-2017-18808NETGEAR ReadyNAS OS 6 devices running ReadyNAS OS versions prior to 6.8.0 are affected by incorrect configuration of security settings.
- CVE-2017-18809NETGEAR ReadyNAS OS 6 devices running ReadyNAS OS versions prior to 6.8.0 are affected by stored XSS.
- CVE-2020-5268Subject Confirmation Method not validated in Saml2 Authentication Services for ASP.NETSustainsys Saml2 · Sustainsys.Saml2
- CVE-2017-18810NETGEAR ReadyNAS OS 6 devices running ReadyNAS OS versions prior to 6.8.0 are affected by stored XSS.
- CVE-2017-18811NETGEAR ReadyNAS OS 6 devices running ReadyNAS OS versions prior to 6.8.0 are affected by stored XSS.
- CVE-2017-18812NETGEAR ReadyNAS OS 6 devices running ReadyNAS OS versions prior to 6.8.0 are affected by stored XSS.
- CVE-2017-18813NETGEAR ReadyNAS OS 6 devices running ReadyNAS OS versions prior to 6.8.0 are affected by stored XSS.
- CVE-2019-8960A Denial of Service vulnerability related to command handling has been identified in FlexNet Publisher lmadmin.exe version 11.16.2.
- CVE-2019-8961A Denial of Service vulnerability related to stack exhaustion has been identified in FlexNet Publisher lmadmin.exe 11.16.2.
- CVE-2017-18814NETGEAR ReadyNAS OS 6 devices running ReadyNAS OS versions prior to 6.8.0 are affected by stored XSS.
- CVE-2017-18815NETGEAR ReadyNAS OS 6 devices, running ReadyNAS OS versions prior to 6.8.0 are affected by stored XSS.
- CVE-2017-18816NETGEAR ReadyNAS OS 6 devices, running ReadyNAS OS versions prior to 6.8.0 are affected by stored XSS.
- CVE-2017-18819NETGEAR ReadyNAS OS 6 devices, running ReadyNAS OS versions prior to 6.8.0 are affected by incorrect configuration of security settings.
- CVE-2017-18820NETGEAR ReadyNAS OS 6 devices running ReadyNAS OS versions prior to 6.8.0 are affected by stored XSS.
- CVE-2017-18821Certain NETGEAR devices are affected by stored XSS.
- CVE-2020-1967Segmentation fault in SSL_check_chainOpenSSL · openssl-src
- CVE-2020-11828In ColorOS (oppo mobile phone operating system, based on AOSP frameworks/native code position/services/surfaceflinger surfaceflinger.CPP), ROppo Color OS
- CVE-2020-11967In IQrouter through 3.3.1, remote attackers can control the device (restart network, reboot, upgrade, reset) because of Incorrect Access Con
- CVE-2020-11968In the web-panel in IQrouter through 3.3.1, remote attackers can read system logs because of Incorrect Access Control.
- CVE-2020-11966In IQrouter through 3.3.1, the Lua function reset_password in the web-panel allows remote attackers to change the root password arbitrarily.
- CVE-2020-11965In IQrouter through 3.3.1, there is a root user without a password, which allows attackers to gain full remote access via SSH.
- CVE-2020-11964In IQrouter through 3.3.1, the Lua function diag_set_password in the web-panel allows remote attackers to change the root password arbitrari
- CVE-2020-11963IQrouter through 3.3.1, when unconfigured, has multiple remote code execution vulnerabilities in the web-panel because of Bash Shell Metacha
- CVE-2020-11958re2c 1.3 has a heap-based buffer overflow in Scanner::fill in parse/scanner.cc via a long lexeme.