# CVEs published 2020-04-21

65 CVEs were published on April 21, 2020: 0 critical, 10 high. Days are UTC.

- [CVE-2020-12051](https://cve.now/CVE-2020-12051.md): The CentralAuth extension through REL1\_34 for MediaWiki allows remote attackers to obtain sensitive hidden account information via an api.ph (no CVSS)
- [CVE-2018-21148](https://cve.now/CVE-2018-21148.md): Certain NETGEAR devices are affected by a stack-based buffer overflow by an authenticated user. (CVSS 6.8)
- [CVE-2018-21147](https://cve.now/CVE-2018-21147.md): Certain NETGEAR devices are affected by a stack-based buffer overflow by an authenticated user. (CVSS 6.8)
- [CVE-2018-21146](https://cve.now/CVE-2018-21146.md): Certain NETGEAR devices are affected by command injection by an authenticated user. (CVSS 6.8)
- [CVE-2018-21145](https://cve.now/CVE-2018-21145.md): Certain NETGEAR devices are affected by a stack-based buffer overflow by an authenticated user. (CVSS 6.8)
- [CVE-2018-21144](https://cve.now/CVE-2018-21144.md): Certain NETGEAR devices are affected by a stack-based buffer overflow by an authenticated user. (CVSS 6.8)
- [CVE-2018-21143](https://cve.now/CVE-2018-21143.md): NETGEAR GS810EMX devices before 1.0.0.5 are affected by disclosure of sensitive information. (CVSS 6.5)
- [CVE-2018-21141](https://cve.now/CVE-2018-21141.md): Certain NETGEAR devices are affected by denial of service. (CVSS 4.5)
- [CVE-2018-21140](https://cve.now/CVE-2018-21140.md): Certain NETGEAR devices are affected by incorrect configuration of security settings. (CVSS 8.8)
- [CVE-2020-5301](https://cve.now/CVE-2020-5301.md): Information disclosure of source code in SimpleSAMLphp (CVSS 3.0, simplesamlphp · simplesamlphp/simplesamlphp)
- [CVE-2020-10569](https://cve.now/CVE-2020-10569.md): SysAid On-Premise 20.1.11, by default, allows the AJP protocol port, which is vulnerable to a GhostCat attack. (no CVSS)
- [CVE-2019-17525](https://cve.now/CVE-2019-17525.md): The login page on D-Link DIR-615 T1 20.10 devices allows remote attackers to bypass the CAPTCHA protection mechanism and conduct brute-force (no CVSS)
- [CVE-2017-18790](https://cve.now/CVE-2017-18790.md): Certain NETGEAR devices are affected by disclosure of sensitive information. (CVSS 6.2)
- [CVE-2017-18791](https://cve.now/CVE-2017-18791.md): Certain NETGEAR devices are affected by CSRF. (CVSS 8.8)
- [CVE-2017-18792](https://cve.now/CVE-2017-18792.md): NETGEAR D6100 devices before 1.0.0.50\_0.0.50 are affected by command injection. (CVSS 8.4)
- [CVE-2017-18793](https://cve.now/CVE-2017-18793.md): NETGEAR R7800 devices before 1.0.2.36 are affected by command injection. (CVSS 6.7)
- [CVE-2017-18794](https://cve.now/CVE-2017-18794.md): Certain NETGEAR devices are affected by command injection. (CVSS 8.4)
- [CVE-2020-11008](https://cve.now/CVE-2020-11008.md): Malicious URLs can still cause Git to send a stored credential to the wrong server (CVSS 4.0, git)
- [CVE-2017-18795](https://cve.now/CVE-2017-18795.md): Certain NETGEAR devices are affected by command injection. (CVSS 6.7)
- [CVE-2017-18796](https://cve.now/CVE-2017-18796.md): Certain NETGEAR devices are affected by command injection. (CVSS 6.7)
- [CVE-2017-18797](https://cve.now/CVE-2017-18797.md): Certain NETGEAR devices are affected by an attacker's ability to read arbitrary files. (CVSS 6.2)
- [CVE-2017-18798](https://cve.now/CVE-2017-18798.md): Certain NETGEAR devices are affected by incorrect configuration of security settings. (CVSS 8.4)
- [CVE-2017-18799](https://cve.now/CVE-2017-18799.md): Certain NETGEAR devices are affected by incorrect configuration of security settings. (CVSS 7.5)
- [CVE-2017-18800](https://cve.now/CVE-2017-18800.md): Certain NETGEAR devices are affected by reflected XSS. (CVSS 6.1)
- [CVE-2017-18801](https://cve.now/CVE-2017-18801.md): Certain NETGEAR devices are affected by command injection. (CVSS 6.7)
- [CVE-2019-4327](https://cve.now/CVE-2019-4327.md): "HCL AppScan Enterprise uses hard-coded credentials which can be exploited by attackers to get unauthorized access to application's encrypte (no CVSS, "HCL AppScan Enterprise Edition")
- [CVE-2017-18802](https://cve.now/CVE-2017-18802.md): Certain NETGEAR devices are affected by command injection. (CVSS 6.7)
- [CVE-2017-18803](https://cve.now/CVE-2017-18803.md): NETGEAR R7800 devices before 1.0.2.30 are affected by incorrect configuration of security settings. (CVSS 6.2)
- [CVE-2020-8895](https://cve.now/CVE-2020-8895.md): DLL Hijacking in Google Earth Pro Windows installer (CVSS 7.8, Google Earth Pro)
- [CVE-2017-18804](https://cve.now/CVE-2017-18804.md): Certain NETGEAR devices are affected by command injection. (CVSS 6.7)
- [CVE-2017-18805](https://cve.now/CVE-2017-18805.md): Certain NETGEAR devices are affected by command injection. (CVSS 6.7)
- [CVE-2020-10787](https://cve.now/CVE-2020-10787.md): An elevation of privilege in Vesta Control Panel through 0.9.8-26 allows an attacker to gain root system access from the admin account via v (no CVSS)
- [CVE-2020-10786](https://cve.now/CVE-2020-10786.md): A remote command execution in Vesta Control Panel through 0.9.8-26 allows any authenticated user to execute arbitrary commands on the system (no CVSS)
- [CVE-2020-11891](https://cve.now/CVE-2020-11891.md): An issue was discovered in Joomla! before 3.9.17. (no CVSS)
- [CVE-2020-11889](https://cve.now/CVE-2020-11889.md): An issue was discovered in Joomla! before 3.9.17. (no CVSS)
- [CVE-2020-11890](https://cve.now/CVE-2020-11890.md): An issue was discovered in Joomla! before 3.9.17. (no CVSS)
- [CVE-2017-18806](https://cve.now/CVE-2017-18806.md): Certain NETGEAR devices are affected by command injection. (CVSS 6.7)
- [CVE-2017-18807](https://cve.now/CVE-2017-18807.md): NETGEAR ReadyNAS OS 6 devices running ReadyNAS OS versions prior to 6.8.0 are affected by stored XSS. (CVSS 5.2)
- [CVE-2017-18808](https://cve.now/CVE-2017-18808.md): NETGEAR ReadyNAS OS 6 devices running ReadyNAS OS versions prior to 6.8.0 are affected by incorrect configuration of security settings. (CVSS 4.2)
- [CVE-2017-18809](https://cve.now/CVE-2017-18809.md): NETGEAR ReadyNAS OS 6 devices running ReadyNAS OS versions prior to 6.8.0 are affected by stored XSS. (CVSS 5.2)
- [CVE-2020-1757](https://cve.now/CVE-2020-1757.md): A flaw was found in all undertow-2.x.x SP1 versions prior to undertow-2.0.30.SP1, all undertow-1.x.x and undertow-2.x.x versions prior to un (CVSS 8.1, Red Hat undertow · io.undertow:undertow-core)
- [CVE-2020-5268](https://cve.now/CVE-2020-5268.md): Subject Confirmation Method not validated in Saml2 Authentication Services for ASP.NET (CVSS 6.5, Sustainsys Saml2 · Sustainsys.Saml2)
- [CVE-2020-1699](https://cve.now/CVE-2020-1699.md): A path traversal flaw was found in the Ceph dashboard implemented in upstream versions v14.2.5, v14.2.6, v15.0.0 of Ceph storage and has bee (CVSS 7.5, The Ceph Project ceph)
- [CVE-2017-18810](https://cve.now/CVE-2017-18810.md): NETGEAR ReadyNAS OS 6 devices running ReadyNAS OS versions prior to 6.8.0 are affected by stored XSS. (CVSS 5.2)
- [CVE-2017-18811](https://cve.now/CVE-2017-18811.md): NETGEAR ReadyNAS OS 6 devices running ReadyNAS OS versions prior to 6.8.0 are affected by stored XSS. (CVSS 5.2)
- [CVE-2017-18812](https://cve.now/CVE-2017-18812.md): NETGEAR ReadyNAS OS 6 devices running ReadyNAS OS versions prior to 6.8.0 are affected by stored XSS. (CVSS 5.2)
- [CVE-2017-18813](https://cve.now/CVE-2017-18813.md): NETGEAR ReadyNAS OS 6 devices running ReadyNAS OS versions prior to 6.8.0 are affected by stored XSS. (CVSS 5.2)
- [CVE-2019-8960](https://cve.now/CVE-2019-8960.md): A Denial of Service vulnerability related to command handling has been identified in FlexNet Publisher lmadmin.exe version 11.16.2. (no CVSS)
- [CVE-2019-8961](https://cve.now/CVE-2019-8961.md): A Denial of Service vulnerability related to stack exhaustion has been identified in FlexNet Publisher lmadmin.exe 11.16.2. (no CVSS)
- [CVE-2017-18814](https://cve.now/CVE-2017-18814.md): NETGEAR ReadyNAS OS 6 devices running ReadyNAS OS versions prior to 6.8.0 are affected by stored XSS. (CVSS 5.2)
- [CVE-2017-18815](https://cve.now/CVE-2017-18815.md): NETGEAR ReadyNAS OS 6 devices, running ReadyNAS OS versions prior to 6.8.0 are affected by stored XSS. (CVSS 5.2)
- [CVE-2017-18816](https://cve.now/CVE-2017-18816.md): NETGEAR ReadyNAS OS 6 devices, running ReadyNAS OS versions prior to 6.8.0 are affected by stored XSS. (CVSS 5.2)
- [CVE-2017-18819](https://cve.now/CVE-2017-18819.md): NETGEAR ReadyNAS OS 6 devices, running ReadyNAS OS versions prior to 6.8.0 are affected by incorrect configuration of security settings. (CVSS 4.0)
- [CVE-2017-18820](https://cve.now/CVE-2017-18820.md): NETGEAR ReadyNAS OS 6 devices running ReadyNAS OS versions prior to 6.8.0 are affected by stored XSS. (CVSS 5.2)
- [CVE-2017-18821](https://cve.now/CVE-2017-18821.md): Certain NETGEAR devices are affected by stored XSS. (CVSS 5.2)
- [CVE-2020-1967](https://cve.now/CVE-2020-1967.md): Segmentation fault in SSL\_check\_chain (no CVSS, OpenSSL · openssl-src)
- [CVE-2020-11828](https://cve.now/CVE-2020-11828.md): In ColorOS (oppo mobile phone operating system, based on AOSP frameworks/native code position/services/surfaceflinger surfaceflinger.CPP), R (no CVSS, Oppo Color OS)
- [CVE-2020-11967](https://cve.now/CVE-2020-11967.md): In IQrouter through 3.3.1, remote attackers can control the device (restart network, reboot, upgrade, reset) because of Incorrect Access Con (no CVSS)
- [CVE-2020-11968](https://cve.now/CVE-2020-11968.md): In the web-panel in IQrouter through 3.3.1, remote attackers can read system logs because of Incorrect Access Control. (no CVSS)
- [CVE-2020-11966](https://cve.now/CVE-2020-11966.md): In IQrouter through 3.3.1, the Lua function reset\_password in the web-panel allows remote attackers to change the root password arbitrarily. (no CVSS)
- [CVE-2020-11965](https://cve.now/CVE-2020-11965.md): In IQrouter through 3.3.1, there is a root user without a password, which allows attackers to gain full remote access via SSH. (no CVSS)
- [CVE-2020-11964](https://cve.now/CVE-2020-11964.md): In IQrouter through 3.3.1, the Lua function diag\_set\_password in the web-panel allows remote attackers to change the root password arbitrari (no CVSS)
- [CVE-2020-11963](https://cve.now/CVE-2020-11963.md): IQrouter through 3.3.1, when unconfigured, has multiple remote code execution vulnerabilities in the web-panel because of Bash Shell Metacha (no CVSS)
- [CVE-2020-8099](https://cve.now/CVE-2020-8099.md): Link Resolution Privilege Escalation Vulnerability in Bitdefender Antivirus Free (VA-8387) (CVSS 7.1, Bitdefender Antivirus Free)
- [CVE-2020-11958](https://cve.now/CVE-2020-11958.md): re2c 1.3 has a heap-based buffer overflow in Scanner::fill in parse/scanner.cc via a long lexeme. (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2020-04-21
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.