CVEs published April 22, 2020
127 CVEs were published on April 22, 2020: 6 critical, 59 high.
- Published
- 127
- Critical
- 6
- High
- 59
- Medium
- 29
- Low
- 4
- Unrated
- 29
- Now in CISA KEV
- 0
- Fix available
- 7
Most affected products
- Foxit PhantomPDF
- 21
- ABB TG/S 3.2 Telephone Gateway · Busch-Jaeger 6186/11 Telef…
- 4
- Foxit Reader
- 4
- Canonical Apport
- 2
- EcoStruxure Machine Expert (all versions)SoMachine, SoMachi…
- 2
- VEEAM One Agent
- 2
- "HCL Connections"
- 1
- ABB System 800xA Base
- 1
- ABB System 800xA Information Manager
- 1
- Alanaktion Phproject
- 1
Critical 6
- CVE-2020-10915This vulnerability allows remote attackers to execute arbitrary code on affected installations of VEEAM One Agent 9.5.4.4587.VEEAM One Agent
- CVE-2020-10914This vulnerability allows remote attackers to execute arbitrary code on affected installations of VEEAM One Agent 9.5.4.4587.VEEAM One Agent
- CVE-2020-7489A CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability exists on EcoStruSoMachine Basic (all versions)EcoStruxure Machine Expert –…
- CVE-2020-11011RCE via file upload in PhprojectAlanaktion Phproject
- CVE-2019-19106ABB/Busch-Jaeger Telephone Gateway TG/S 3.2 Access Control issuesABB TG/S 3.2 Telephone Gateway · Busch-Jaeger 6186/11 Telef…
- CVE-2019-19104ABB/Busch-Jaeger Telephone Gateway TG/S 3.2 Improper Authentication and Access ControlABB TG/S 3.2 Telephone Gateway · Busch-Jaeger 6186/11 Telef…
High 59
- CVE-2020-10913This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.7.0.29478.Foxit PhantomPDF
- CVE-2020-10911This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.7.0.29478.Foxit PhantomPDF
- CVE-2020-10912This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.7.0.29478.Foxit PhantomPDF
- CVE-2020-10908This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.7.0.29478.Foxit PhantomPDF
- CVE-2020-10909This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.7.0.29478.Foxit PhantomPDF
- CVE-2020-10910This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.7.0.29478.Foxit PhantomPDF
- CVE-2020-10906This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 9.7.1.29511.Foxit Reader
- CVE-2020-10907This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 9.7.1.29511.Foxit Reader
- CVE-2020-10904This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.7.1.29511.Foxit PhantomPDF
- CVE-2020-10902This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.7.1.29511.Foxit PhantomPDF
- CVE-2020-10900This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 9.7.1.29511.Foxit Reader
- CVE-2020-10898This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.7.1.29511.Foxit PhantomPDF
- CVE-2020-10899This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 9.7.1.29511.Foxit Reader
- CVE-2020-10896This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.7.1.29511.Foxit PhantomPDF
- CVE-2020-10897This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.7.1.29511.Foxit PhantomPDF
- CVE-2020-10893This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.7.1.29511.Foxit PhantomPDF
- CVE-2020-10895This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.7.1.29511.Foxit PhantomPDF
- CVE-2020-10891This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.7.0.29478.Foxit PhantomPDF
- CVE-2020-10892This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.7.0.29478.Foxit PhantomPDF
- CVE-2020-10889This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.7.0.29478.Foxit PhantomPDF
- CVE-2020-10890This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.7.0.29478.Foxit PhantomPDF
- CVE-2020-1983libslirp: use after free vulnerability cause a denial of service.libslirp
- CVE-2020-7488A CWE-319: Cleartext Transmission of Sensitive Information vulnerability exists which could leak sensitive information transmitted between tEcoStruxure Machine Expert (all versions)SoMachine, SoMachi…
- CVE-2018-21130Certain NETGEAR devices are affected by command injection by an unauthenticated attacker.
- CVE-2018-21129Certain NETGEAR devices are affected by disclosure of sensitive information.
- CVE-2018-21128Certain NETGEAR devices are affected by authentication bypass.
- CVE-2018-21127Certain NETGEAR devices are affected by command injection by an unauthenticated attacker.
- CVE-2017-18752Certain NETGEAR devices are affected by an attacker's ability to read arbitrary files.
- CVE-2017-18755Certain NETGEAR devices are affected by CSRF.
- CVE-2017-18756Certain NETGEAR devices are affected by incorrect configuration of security settings.
- CVE-2017-18758Certain NETGEAR devices are affected by a stack-based buffer overflow by an authenticated user.
- CVE-2018-21126Certain NETGEAR devices are affected by command injection by an unauthenticated attacker.
- CVE-2018-21125NETGEAR WAC510 devices before 5.0.0.17 are affected by authentication bypass.
- CVE-2018-21124NETGEAR WAC510 devices before 5.0.0.17 are affected by privilege escalation.
- CVE-2018-21123Certain NETGEAR devices are affected by command injection by an unauthenticated attacker.
- CVE-2017-18762Certain NETGEAR devices are affected by command injection by an unauthenticated attacker.
- CVE-2017-18763Certain NETGEAR devices are affected by incorrect configuration of security settings.
- CVE-2017-18764Certain NETGEAR devices are affected by command injection by an unauthenticated attacker.
- CVE-2017-18766Certain NETGEAR devices are affected by an attacker's ability to read arbitrary files.
- CVE-2017-18768Certain NETGEAR devices are affected by CSRF.
- CVE-2020-10712A flaw was found in OpenShift Container Platform version 4.1 and later.Red Hat openshift/cluster-image-registry-operator
- CVE-2018-21121Certain NETGEAR devices are affected by authentication bypass.
- CVE-2018-21118NETGEAR XR500 devices before 2.3.2.32 are affected by authentication bypass.
- CVE-2018-21117NETGEAR XR500 devices before 2.3.2.32 are affected by remote code execution by unauthenticated attackers via the traceroute handler.
- CVE-2018-21116NETGEAR XR500 devices before 2.3.2.32 are affected by remote code execution by unauthenticated attackers.
- CVE-2017-18772Certain NETGEAR devices are affected by authentication bypass.
- CVE-2020-8477ABB System 800xA Information Manager Remote Code ExecutionABB System 800xA Information Manager
- CVE-2018-21115NETGEAR XR500 devices before 2.3.2.32 are affected by remote code execution by unauthenticated attackers.
- CVE-2017-18775Certain NETGEAR devices are affected by CSRF.
- CVE-2017-18776Certain NETGEAR devices are affected by authentication bypass.
- CVE-2017-18777Certain NETGEAR devices are affected by administrative password disclosure.
- CVE-2017-18778Certain NETGEAR devices are affected by incorrect configuration of security settings.
- CVE-2018-21113Certain NETGEAR devices are affected by command injection by an unauthenticated attacker.
- CVE-2017-18779Certain NETGEAR devices are affected by a buffer overflow.
- CVE-2017-18781Certain NETGEAR devices are affected by CSRF.
- CVE-2017-18782Certain NETGEAR devices are affected by CSRF.
- CVE-2017-18786Certain NETGEAR devices are affected by command injection.
- CVE-2020-8474ABB System 800xA Weak Registry PermissionsABB System 800xA Base
- CVE-2017-18787Certain NETGEAR devices are affected by command injection.
Medium, low and unrated 62
- CVE-2020-7350Metasploit Framework Plugin Libnotify Command InjectionRapid7 Metasploit Framework
- CVE-2020-8833Apport race condition in crash report permissionsCanonical Apport
- CVE-2020-8831World writable root owned lock file created in user controllable locationCanonical Apport
- CVE-2020-8867This vulnerability allows remote attackers to create a denial-of-service condition on affected installations of OPC Foundation UA .NET StandOPC Foundation UA .NET Standard · OPCFoundation.NetStandard…
- CVE-2020-10905This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit PhantomPDF 9.7.1.29511.Foxit PhantomPDF
- CVE-2020-10903This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit PhantomPDF 9.7.1.29511.Foxit PhantomPDF
- CVE-2020-10901This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit PhantomPDF 9.7.1.29511.Foxit PhantomPDF
- CVE-2020-10894This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit PhantomPDF 9.7.1.29511.Foxit PhantomPDF
- CVE-2018-21151Certain NETGEAR devices are affected by a buffer overflow by an authenticated user.
- CVE-2018-21150Certain NETGEAR devices are affected by a stack-based buffer overflow by an authenticated user.
- CVE-2020-11649An issue was discovered in GitLab CE and EE 8.15 through 12.9.2.
- CVE-2020-11506An issue was discovered in GitLab 10.7.0 and later through 12.9.2.
- CVE-2020-11505An issue was discovered in GitLab Community Edition (CE) and Enterprise Edition (EE) before 12.7.9, 12.8.x before 12.8.9, and 12.9.x before
- CVE-2020-7487A CWE-345: Insufficient Verification of Data Authenticity vulnerability exists which could allow the attacker to execute malicious code on tEcoStruxure Machine Expert (all versions)SoMachine, SoMachi…
- CVE-2020-7490A CWE-426: Untrusted Search Path vulnerability exists in Vijeo Designer Basic (V1.1 HotFix 15 and prior) and Vijeo Designer (V6.9 SP9 and prVijeo Designer Basic (V1.1 HotFix 15 and prior) and Vijeo D…
- CVE-2019-6859A CWE-798: Use of Hardcoded Credentials vulnerability exists in Modicon Controllers (All versions of the following CPUs and Communication MoModicon Controllers
- CVE-2018-18405jQuery v2.2.2 allows XSS via a crafted onerror attribute of an IMG element.
- CVE-2020-7055An issue was discovered in Elementor 2.7.4.
- CVE-2020-12066CServer::SendMsg in engine/server/server.cpp in Teeworlds 0.7.x before 0.7.5 allows remote attackers to shut down the server.
- CVE-2019-20787Teeworlds before 0.7.4 has an integer overflow when computing a tilemap size.
- CVE-2017-18754Certain NETGEAR devices are affected by command injection by an authenticated user.
- CVE-2017-18757Certain NETGEAR devices are affected by incorrect configuration of security settings.
- CVE-2017-18759Certain NETGEAR devices are affected by a stack-based buffer overflow by an authenticated user.
- CVE-2017-18761NETGEAR R8000 devices before 1.0.4.2 are affected by a stack-based buffer overflow by an authenticated user.
- CVE-2017-18765Certain NETGEAR devices are affected by denial of service.
- CVE-2017-18767Certain NETGEAR devices are affected by command injection by an authenticated user.
- CVE-2018-21122Certain NETGEAR devices are affected by denial of service.
- CVE-2020-7642lazysizes through 5.2.0 allows execution of malicious JavaScript.lazysizes
- CVE-2018-21120Certain NETGEAR devices are affected by CSRF.
- CVE-2018-21119Certain NETGEAR devices are affected by command injection by an authenticated user.
- CVE-2020-5740Improper Input Validation in Plex Media Server on Windows allows a local, unauthenticated attacker to execute arbitrary Python code with SYSPlex Media Server
- CVE-2017-18769Certain NETGEAR devices are affected by an attacker's ability to read arbitrary files.
- CVE-2020-4085"HCL Connections is vulnerable to possible information leakage and could disclose sensitive information via stack trace to a local user.""HCL Connections"
- CVE-2017-18770Certain NETGEAR devices are affected by a buffer overflow by an authenticated user.
- CVE-2017-18773Certain NETGEAR devices are affected by command injection by an authenticated user.
- CVE-2018-21114Certain NETGEAR devices are affected by command injection by an authenticated user.
- CVE-2019-19107ABB/Busch-Jaeger Telephone Gateway TG/S 3.2 Information ExposureABB TG/S 3.2 Telephone Gateway · Busch-Jaeger 6186/11 Telef…
- CVE-2017-18780Certain NETGEAR devices are affected by denial of service.
- CVE-2019-19105ABB/Busch-Jaeger Telephone Gateway TG/S 3.2 Plaintext storing of credentialsABB TG/S 3.2 Telephone Gateway · Busch-Jaeger 6186/11 Telef…
- CVE-2017-18783Certain NETGEAR devices are affected by XSS.
- CVE-2017-18784Certain NETGEAR devices are affected by XSS.
- CVE-2018-21112Certain NETGEAR devices are affected by command injection by an authenticated user.
- CVE-2018-21111Certain NETGEAR devices are affected by a stack-based buffer overflow by an authenticated user.
- CVE-2017-18785Certain NETGEAR devices are affected by XSS.
- CVE-2020-11938In JetBrains TeamCity 2018.2 through 2019.2.1, a project administrator was able to see scrambled password parameters used in a project.
- CVE-2020-11796In JetBrains Space through 2020-04-22, the password authentication implementation was insecure.
- CVE-2020-11795In JetBrains Space through 2020-04-22, the session timeout period was configured improperly.
- CVE-2020-11693JetBrains YouTrack before 2020.1.659 was vulnerable to DoS that could be caused by attaching a malformed TIFF file to an issue.
- CVE-2020-11692In JetBrains YouTrack before 2020.1.659, DB export was accessible to read-only administrators.
- CVE-2020-11691In JetBrains Hub before 2020.1.12099, content spoofing in the Hub OAuth error message was possible.
- CVE-2020-11690In JetBrains IntelliJ IDEA before 2020.1, the license server could be resolved to an untrusted host in some cases.
- CVE-2020-11689In JetBrains TeamCity before 2019.2.1, a user without appropriate permissions was able to import settings from the settings.kts file.
- CVE-2020-11688In JetBrains TeamCity before 2019.2.1, the application state is kept alive after a user ends his session.
- CVE-2020-11687In JetBrains TeamCity before 2019.2.2, password values were shown in an unmasked format on several pages.
- CVE-2020-11686In JetBrains TeamCity before 2019.1.4, a project administrator was able to retrieve some TeamCity server settings.
- CVE-2020-11685In JetBrains GoLand before 2019.3.2, the plugin repository was accessed via HTTP instead of HTTPS.
- CVE-2020-11416JetBrains Space through 2020-04-22 allows stored XSS in Chats.
- CVE-2017-18788Certain NETGEAR devices are affected by command injection by an authenticated user.
- CVE-2017-18789Certain NETGEAR devices are affected by disclosure of sensitive information.
- CVE-2020-11539An issue was discovered on Tata Sonata Smart SF Rush 1.12 devices.
- CVE-2019-20102The attachment-uploading feature in Atlassian Confluence Server from version 6.14.0 through version 6.14.3, and version 6.15.0 before versioAtlassian Confluence Server
- CVE-2020-12059An issue was discovered in Ceph through 13.2.9.