CVEs published April 24, 2020
70 CVEs were published on April 24, 2020: 0 critical, 22 high. 2 are now in CISA KEV.
- Published
- 70
- Critical
- 0
- High
- 22
- Medium
- 28
- Low
- 0
- Unrated
- 20
- Now in CISA KEV
- 2
- Fix available
- 15
Most affected products
- BIG-IQ
- 3
- Mozilla Firefox
- 3
- Mozilla Thunderbird · Mozilla Firefox ESR +1
- 3
- HPE IOT + GCP
- 2
- IBM Cloud App Management
- 2
- Mozilla Firefox ESR
- 2
- Mozilla Thunderbird · Mozilla Firefox
- 2
- admidio
- 1
- github.com/grafana/grafana
- 1
- Helm · helm.sh/helm/v3
- 1
High 22
- CVE-2020-11004SQL Injection in Admidioadmidio
- CVE-2020-11013lookup Function Information Discolosure in HelmHelm · helm.sh/helm/v3
- CVE-2020-6819Under certain conditions, when running the nsDocShell destructor, a race condition can cause a use-after-free.Mozilla Thunderbird · Mozilla Firefox
- CVE-2020-6820Under certain conditions, when handling a ReadableStream, a race condition can cause a use-after-free.Mozilla Thunderbird · Mozilla Firefox
- CVE-2017-18703Certain NETGEAR devices are affected by CSRF.
- CVE-2017-18705Certain NETGEAR devices are affected by incorrect configuration of security settings.
- CVE-2017-18708Certain NETGEAR devices are affected by CSRF.
- CVE-2017-18716Certain NETGEAR devices are affected by a stack-based buffer overflow by an unauthenticated attacker.
- CVE-2017-18717Certain NETGEAR devices are affected by a stack-based buffer overflow by an unauthenticated attacker.
- CVE-2017-18718Certain NETGEAR devices are affected by a stack-based buffer overflow by an unauthenticated attacker.
- CVE-2017-18719Certain NETGEAR devices are affected by a stack-based buffer overflow by an unauthenticated attacker.
- CVE-2017-18720Certain NETGEAR devices are affected by authentication bypass.
- CVE-2017-18721Certain NETGEAR devices are affected by a stack-based buffer overflow by an unauthenticated attacker.
- CVE-2017-18722Certain NETGEAR devices are affected by a stack-based buffer overflow by an unauthenticated attacker.
- CVE-2017-18723Certain NETGEAR devices are affected by a stack-based buffer overflow by an unauthenticated attacker.
- CVE-2017-18724Certain NETGEAR devices are affected by a stack-based buffer overflow by an unauthenticated attacker.
- CVE-2017-18725Certain NETGEAR devices are affected by a stack-based buffer overflow by an unauthenticated attacker.
- CVE-2017-18726Certain NETGEAR devices are affected by a stack-based buffer overflow by an unauthenticated attacker.
- CVE-2017-18727Certain NETGEAR devices are affected by a stack-based buffer overflow by an unauthenticated attacker.
- CVE-2017-18728Certain NETGEAR devices are affected by a stack-based buffer overflow by an unauthenticated attacker.
- CVE-2017-18729Certain NETGEAR devices are affected by a stack-based buffer overflow by an unauthenticated attacker.
- CVE-2017-18730Certain NETGEAR devices are affected by a stack-based buffer overflow by an unauthenticated attacker.
Medium, low and unrated 48
- CVE-2020-12070The Advanced Woo Search plugin version through 1.99 for Wordpress suffers from a sensitive information disclosure vulnerability in every aja
- CVE-2020-6212Egypt localized withholding tax reports Clearing of Liabilities and Remittance Statement and Summary in SAP ERP (versions 618, 730, EAPPLGLOSAP SE SAP ERP · SAP SE SAP S/4 HANA
- CVE-2020-6213SAP NetWeaver AS ABAP Business Server Pages Test Application SBSPEXT_PHTMLB, versions 700, 701, 702, 730, 731, 740, 750, 751, 752, 753, 754,SAP SE SAP NetWeaver AS ABAP
- CVE-2020-12245Grafana before 6.7.3 allows table-panel XSS via column.title or cellLinkTooltip.github.com/grafana/grafana
- CVE-2020-7134A remote access to sensitive data vulnerability was discovered in HPE IOT + GCP version(s): 1.4.0, 1.4.1, 1.4.2, 1.2.4.2.HPE IOT + GCP
- CVE-2020-7133A unauthorized remote access vulnerability was discovered in HPE IOT + GCP version(s): 1.4.0, 1.4.1, 1.4.2, 1.2.4.2.HPE IOT + GCP
- CVE-2020-1741A flaw was found in openshift-ansible.Red Hat openshift-ansible
- CVE-2020-7131This document describes a security vulnerability in Blade Maintenance Entity, Integrated Maintenance Entity and Maintenance Entity products.Integrated Maintenance Entity T1805; Maintenance Entity T28…
- CVE-2020-6821When reading from areas partially or fully outside the source resource with WebGL's <code>copyTexSubImage</code> method, the specification rMozilla Thunderbird · Mozilla Firefox ESR +1
- CVE-2020-6822On 32-bit builds, an out of bounds write could have occurred when processing an image larger than 4 GB in <code>GMPDecodeData</code>.Mozilla Thunderbird · Mozilla Firefox ESR +1
- CVE-2020-6823A malicious extension could have called <code>browser.identity.launchWebAuthFlow</code>, controlling the redirect_uri, and through the PromiMozilla Firefox
- CVE-2020-6824Initially, a user opens a Private Browsing Window and generates a password for a site, then closes the Private Browsing Window but leaves FiMozilla Firefox
- CVE-2020-6826Mozilla developers Tyson Smith, Bob Clary, and Alexandru Michis reported memory safety bugs present in Firefox 74.Mozilla Firefox
- CVE-2020-6825Mozilla developers and community members Tyson Smith and Christian Holler reported memory safety bugs present in Firefox 74 and Firefox ESR Mozilla Thunderbird · Mozilla Firefox ESR +1
- CVE-2020-4267IBM MQ and MQ Appliance 8.0, 9.1 LTS, and 9.1 CD could allow an authenticated user cause a denial of service due to a memory leak.IBM MQ Appliance
- CVE-2019-4751IBM Cloud App Management 2019.3.0 and 2019.4.0 reveals a stack trace on certain API requests which can allow an attacker further informationIBM Cloud App Management
- CVE-2019-4750IBM Cloud App Management 2019.3.0 and 2019.4.0 is vulnerable to cross-site request forgery which could allow an attacker to execute maliciouIBM Cloud App Management
- CVE-2020-6827When following a link that opened an intent://-schemed URL, causing a custom tab to be opened, Firefox for Android could be tricked into disMozilla Firefox ESR
- CVE-2020-6828A malicious Android application could craft an Intent that would have been processed by Firefox for Android and potentially result in a fileMozilla Firefox ESR
- CVE-2018-21228Certain NETGEAR devices are affected by command injection by an authenticated user.
- CVE-2018-21227Certain NETGEAR devices are affected by command injection by an authenticated user.
- CVE-2018-21229Certain NETGEAR devices are affected by incorrect configuration of security settings.
- CVE-2018-21230Certain NETGEAR devices are affected by incorrect configuration of security settings.
- CVE-2018-21231Certain NETGEAR devices are affected by incorrect configuration of security settings.
- CVE-2017-18697Certain NETGEAR devices are affected by a stack-based buffer overflow by an authenticated user.
- CVE-2017-18698Certain NETGEAR devices are affected by a stack-based buffer overflow by an authenticated user.
- CVE-2017-18699Certain NETGEAR devices are affected by a stack-based buffer overflow by an authenticated user.
- CVE-2017-18700Certain NETGEAR devices are affected by stored XSS.
- CVE-2017-18701Certain NETGEAR devices are affected by reflected XSS.
- CVE-2017-18702NETGEAR R6220 devices before 1.1.0.60 are affected by incorrect configuration of security settings.
- CVE-2017-18704Certain NETGEAR devices are affected by an attacker's ability to read arbitrary files.
- CVE-2017-18706Certain NETGEAR devices are affected by incorrect configuration of security settings.
- CVE-2017-18707Certain NETGEAR devices are affected by a buffer overflow by an authenticated user.
- CVE-2017-18709Certain NETGEAR devices are affected by incorrect configuration of security settings.
- CVE-2017-18710Certain NETGEAR devices are affected by disclosure of sensitive information.
- CVE-2017-18711Certain NETGEAR devices are affected by incorrect configuration of security settings.
- CVE-2017-18712Certain NETGEAR devices are affected by an attacker's ability to read arbitrary files.
- CVE-2017-18713Certain NETGEAR devices are affected by an attacker's ability to read arbitrary files.
- CVE-2017-18714NETGEAR WNDR4500v3 devices before 1.0.0.48 are affected by denial of service.
- CVE-2017-18715Certain NETGEAR devices are affected by reflected XSS.
- CVE-2020-5870In BIG-IQ 5.2.0-7.0.0, high availability (HA) synchronization mechanisms do not use any form of authentication for connecting to the peer.BIG-IQ
- CVE-2020-5869In BIG-IQ 5.2.0-7.0.0, high availability (HA) synchronization is not secure by TLS and may allow on-path attackers to read / modify confidenBIG-IQ
- CVE-2020-5868In BIG-IQ 6.0.0-7.0.0, a remote access vulnerability has been discovered that may allow a remote user to execute shell commands on affected BIG-IQ
- CVE-2017-18731Certain NETGEAR devices are affected by incorrect configuration of security settings.
- CVE-2020-12137GNU Mailman 2.x before 2.1.30 uses the .obj extension for scrubbed application/octet-stream MIME parts.
- CVE-2020-12063A certain Postfix 2.10.1-7 package could allow an attacker to send an email from an arbitrary-looking sender via a homoglyph attack, as demo
- CVE-2020-12135bson before 0.8 incorrectly uses int rather than size_t for many variables, parameters, and return values.
- CVE-2020-12134Nanometrics Centaur through 4.3.23 and TitanSMA through 4.2.20 mishandle access control for the syslog log.