# CVEs published 2020-04-24

70 CVEs were published on April 24, 2020: 0 critical, 22 high. 2 are now in CISA KEV. Days are UTC.

- [CVE-2020-12070](https://cve.now/CVE-2020-12070.md): The Advanced Woo Search plugin version through 1.99 for Wordpress suffers from a sensitive information disclosure vulnerability in every aja (no CVSS)
- [CVE-2020-6212](https://cve.now/CVE-2020-6212.md): Egypt localized withholding tax reports Clearing of Liabilities and Remittance Statement and Summary in SAP ERP (versions 618, 730, EAPPLGLO (CVSS 5.4, SAP SE SAP ERP · SAP SE SAP S/4 HANA)
- [CVE-2020-6213](https://cve.now/CVE-2020-6213.md): SAP NetWeaver AS ABAP Business Server Pages Test Application SBSPEXT\_PHTMLB, versions 700, 701, 702, 730, 731, 740, 750, 751, 752, 753, 754, (CVSS 6.1, SAP SE SAP NetWeaver AS ABAP)
- [CVE-2020-11004](https://cve.now/CVE-2020-11004.md): SQL Injection in Admidio (CVSS 7.7, admidio)
- [CVE-2020-12245](https://cve.now/CVE-2020-12245.md): Grafana before 6.7.3 allows table-panel XSS via column.title or cellLinkTooltip. (no CVSS, github.com/grafana/grafana)
- [CVE-2020-11013](https://cve.now/CVE-2020-11013.md): lookup Function Information Discolosure in Helm (CVSS 8.5, Helm · helm.sh/helm/v3)
- [CVE-2020-7134](https://cve.now/CVE-2020-7134.md): A remote access to sensitive data vulnerability was discovered in HPE IOT + GCP version(s): 1.4.0, 1.4.1, 1.4.2, 1.2.4.2. (no CVSS, HPE IOT + GCP)
- [CVE-2020-7133](https://cve.now/CVE-2020-7133.md): A unauthorized remote access vulnerability was discovered in HPE IOT + GCP version(s): 1.4.0, 1.4.1, 1.4.2, 1.2.4.2. (no CVSS, HPE IOT + GCP)
- [CVE-2020-1741](https://cve.now/CVE-2020-1741.md): A flaw was found in openshift-ansible. (CVSS 5.9, Red Hat openshift-ansible)
- [CVE-2020-7131](https://cve.now/CVE-2020-7131.md): This document describes a security vulnerability in Blade Maintenance Entity, Integrated Maintenance Entity and Maintenance Entity products. (no CVSS, Integrated Maintenance Entity T1805; Maintenance Entity T28…)
- [CVE-2020-6819](https://cve.now/CVE-2020-6819.md): Under certain conditions, when running the nsDocShell destructor, a race condition can cause a use-after-free. (CVSS 8.1, KEV, Mozilla Thunderbird · Mozilla Firefox)
- [CVE-2020-6820](https://cve.now/CVE-2020-6820.md): Under certain conditions, when handling a ReadableStream, a race condition can cause a use-after-free. (CVSS 8.1, KEV, Mozilla Thunderbird · Mozilla Firefox)
- [CVE-2020-6821](https://cve.now/CVE-2020-6821.md): When reading from areas partially or fully outside the source resource with WebGL's \<code\>copyTexSubImage\</code\> method, the specification r (no CVSS, Mozilla Thunderbird · Mozilla Firefox ESR +1)
- [CVE-2020-6822](https://cve.now/CVE-2020-6822.md): On 32-bit builds, an out of bounds write could have occurred when processing an image larger than 4 GB in \<code\>GMPDecodeData\</code\>. (no CVSS, Mozilla Thunderbird · Mozilla Firefox ESR +1)
- [CVE-2020-6823](https://cve.now/CVE-2020-6823.md): A malicious extension could have called \<code\>browser.identity.launchWebAuthFlow\</code\>, controlling the redirect\_uri, and through the Promi (no CVSS, Mozilla Firefox)
- [CVE-2020-6824](https://cve.now/CVE-2020-6824.md): Initially, a user opens a Private Browsing Window and generates a password for a site, then closes the Private Browsing Window but leaves Fi (no CVSS, Mozilla Firefox)
- [CVE-2020-6826](https://cve.now/CVE-2020-6826.md): Mozilla developers Tyson Smith, Bob Clary, and Alexandru Michis reported memory safety bugs present in Firefox 74. (no CVSS, Mozilla Firefox)
- [CVE-2020-6825](https://cve.now/CVE-2020-6825.md): Mozilla developers and community members Tyson Smith and Christian Holler reported memory safety bugs present in Firefox 74 and Firefox ESR (no CVSS, Mozilla Thunderbird · Mozilla Firefox ESR +1)
- [CVE-2020-4267](https://cve.now/CVE-2020-4267.md): IBM MQ and MQ Appliance 8.0, 9.1 LTS, and 9.1 CD could allow an authenticated user cause a denial of service due to a memory leak. (CVSS 5.3, IBM MQ Appliance)
- [CVE-2019-4751](https://cve.now/CVE-2019-4751.md): IBM Cloud App Management 2019.3.0 and 2019.4.0 reveals a stack trace on certain API requests which can allow an attacker further information (CVSS 5.3, IBM Cloud App Management)
- [CVE-2019-4750](https://cve.now/CVE-2019-4750.md): IBM Cloud App Management 2019.3.0 and 2019.4.0 is vulnerable to cross-site request forgery which could allow an attacker to execute maliciou (CVSS 4.3, IBM Cloud App Management)
- [CVE-2020-6827](https://cve.now/CVE-2020-6827.md): When following a link that opened an intent://-schemed URL, causing a custom tab to be opened, Firefox for Android could be tricked into dis (no CVSS, Mozilla Firefox ESR)
- [CVE-2020-6828](https://cve.now/CVE-2020-6828.md): A malicious Android application could craft an Intent that would have been processed by Firefox for Android and potentially result in a file (no CVSS, Mozilla Firefox ESR)
- [CVE-2018-21228](https://cve.now/CVE-2018-21228.md): Certain NETGEAR devices are affected by command injection by an authenticated user. (CVSS 6.8)
- [CVE-2018-21227](https://cve.now/CVE-2018-21227.md): Certain NETGEAR devices are affected by command injection by an authenticated user. (CVSS 6.8)
- [CVE-2018-21229](https://cve.now/CVE-2018-21229.md): Certain NETGEAR devices are affected by incorrect configuration of security settings. (CVSS 5.3)
- [CVE-2018-21230](https://cve.now/CVE-2018-21230.md): Certain NETGEAR devices are affected by incorrect configuration of security settings. (CVSS 5.2)
- [CVE-2018-21231](https://cve.now/CVE-2018-21231.md): Certain NETGEAR devices are affected by incorrect configuration of security settings. (CVSS 5.2)
- [CVE-2017-18697](https://cve.now/CVE-2017-18697.md): Certain NETGEAR devices are affected by a stack-based buffer overflow by an authenticated user. (CVSS 6.8)
- [CVE-2017-18698](https://cve.now/CVE-2017-18698.md): Certain NETGEAR devices are affected by a stack-based buffer overflow by an authenticated user. (CVSS 6.8)
- [CVE-2017-18699](https://cve.now/CVE-2017-18699.md): Certain NETGEAR devices are affected by a stack-based buffer overflow by an authenticated user. (CVSS 6.8)
- [CVE-2017-18700](https://cve.now/CVE-2017-18700.md): Certain NETGEAR devices are affected by stored XSS. (CVSS 5.2)
- [CVE-2017-18701](https://cve.now/CVE-2017-18701.md): Certain NETGEAR devices are affected by reflected XSS. (CVSS 5.2)
- [CVE-2017-18702](https://cve.now/CVE-2017-18702.md): NETGEAR R6220 devices before 1.1.0.60 are affected by incorrect configuration of security settings. (CVSS 5.2)
- [CVE-2017-18703](https://cve.now/CVE-2017-18703.md): Certain NETGEAR devices are affected by CSRF. (CVSS 8.8)
- [CVE-2017-18704](https://cve.now/CVE-2017-18704.md): Certain NETGEAR devices are affected by an attacker's ability to read arbitrary files. (CVSS 6.5)
- [CVE-2017-18705](https://cve.now/CVE-2017-18705.md): Certain NETGEAR devices are affected by incorrect configuration of security settings. (CVSS 8.8)
- [CVE-2017-18706](https://cve.now/CVE-2017-18706.md): Certain NETGEAR devices are affected by incorrect configuration of security settings. (CVSS 6.5)
- [CVE-2017-18707](https://cve.now/CVE-2017-18707.md): Certain NETGEAR devices are affected by a buffer overflow by an authenticated user. (CVSS 6.8)
- [CVE-2017-18708](https://cve.now/CVE-2017-18708.md): Certain NETGEAR devices are affected by CSRF. (CVSS 8.8)
- [CVE-2017-18709](https://cve.now/CVE-2017-18709.md): Certain NETGEAR devices are affected by incorrect configuration of security settings. (CVSS 4.0)
- [CVE-2017-18710](https://cve.now/CVE-2017-18710.md): Certain NETGEAR devices are affected by disclosure of sensitive information. (CVSS 4.3)
- [CVE-2017-18711](https://cve.now/CVE-2017-18711.md): Certain NETGEAR devices are affected by incorrect configuration of security settings. (CVSS 6.3)
- [CVE-2017-18712](https://cve.now/CVE-2017-18712.md): Certain NETGEAR devices are affected by an attacker's ability to read arbitrary files. (CVSS 6.5)
- [CVE-2017-18713](https://cve.now/CVE-2017-18713.md): Certain NETGEAR devices are affected by an attacker's ability to read arbitrary files. (CVSS 6.5)
- [CVE-2017-18714](https://cve.now/CVE-2017-18714.md): NETGEAR WNDR4500v3 devices before 1.0.0.48 are affected by denial of service. (CVSS 6.5)
- [CVE-2017-18715](https://cve.now/CVE-2017-18715.md): Certain NETGEAR devices are affected by reflected XSS. (CVSS 5.2)
- [CVE-2017-18716](https://cve.now/CVE-2017-18716.md): Certain NETGEAR devices are affected by a stack-based buffer overflow by an unauthenticated attacker. (CVSS 8.8)
- [CVE-2017-18717](https://cve.now/CVE-2017-18717.md): Certain NETGEAR devices are affected by a stack-based buffer overflow by an unauthenticated attacker. (CVSS 8.8)
- [CVE-2017-18718](https://cve.now/CVE-2017-18718.md): Certain NETGEAR devices are affected by a stack-based buffer overflow by an unauthenticated attacker. (CVSS 8.8)
- [CVE-2017-18719](https://cve.now/CVE-2017-18719.md): Certain NETGEAR devices are affected by a stack-based buffer overflow by an unauthenticated attacker. (CVSS 8.8)
- [CVE-2020-5870](https://cve.now/CVE-2020-5870.md): In BIG-IQ 5.2.0-7.0.0, high availability (HA) synchronization mechanisms do not use any form of authentication for connecting to the peer. (no CVSS, BIG-IQ)
- [CVE-2017-18720](https://cve.now/CVE-2017-18720.md): Certain NETGEAR devices are affected by authentication bypass. (CVSS 8.8)
- [CVE-2017-18721](https://cve.now/CVE-2017-18721.md): Certain NETGEAR devices are affected by a stack-based buffer overflow by an unauthenticated attacker. (CVSS 8.8)
- [CVE-2017-18722](https://cve.now/CVE-2017-18722.md): Certain NETGEAR devices are affected by a stack-based buffer overflow by an unauthenticated attacker. (CVSS 8.8)
- [CVE-2017-18723](https://cve.now/CVE-2017-18723.md): Certain NETGEAR devices are affected by a stack-based buffer overflow by an unauthenticated attacker. (CVSS 8.8)
- [CVE-2017-18724](https://cve.now/CVE-2017-18724.md): Certain NETGEAR devices are affected by a stack-based buffer overflow by an unauthenticated attacker. (CVSS 8.8)
- [CVE-2017-18725](https://cve.now/CVE-2017-18725.md): Certain NETGEAR devices are affected by a stack-based buffer overflow by an unauthenticated attacker. (CVSS 8.8)
- [CVE-2017-18726](https://cve.now/CVE-2017-18726.md): Certain NETGEAR devices are affected by a stack-based buffer overflow by an unauthenticated attacker. (CVSS 8.8)
- [CVE-2020-5869](https://cve.now/CVE-2020-5869.md): In BIG-IQ 5.2.0-7.0.0, high availability (HA) synchronization is not secure by TLS and may allow on-path attackers to read / modify confiden (no CVSS, BIG-IQ)
- [CVE-2017-18727](https://cve.now/CVE-2017-18727.md): Certain NETGEAR devices are affected by a stack-based buffer overflow by an unauthenticated attacker. (CVSS 8.8)
- [CVE-2017-18728](https://cve.now/CVE-2017-18728.md): Certain NETGEAR devices are affected by a stack-based buffer overflow by an unauthenticated attacker. (CVSS 8.8)
- [CVE-2017-18729](https://cve.now/CVE-2017-18729.md): Certain NETGEAR devices are affected by a stack-based buffer overflow by an unauthenticated attacker. (CVSS 8.8)
- [CVE-2020-5868](https://cve.now/CVE-2020-5868.md): In BIG-IQ 6.0.0-7.0.0, a remote access vulnerability has been discovered that may allow a remote user to execute shell commands on affected (no CVSS, BIG-IQ)
- [CVE-2017-18730](https://cve.now/CVE-2017-18730.md): Certain NETGEAR devices are affected by a stack-based buffer overflow by an unauthenticated attacker. (CVSS 8.8)
- [CVE-2017-18731](https://cve.now/CVE-2017-18731.md): Certain NETGEAR devices are affected by incorrect configuration of security settings. (CVSS 6.3)
- [CVE-2020-12137](https://cve.now/CVE-2020-12137.md): GNU Mailman 2.x before 2.1.30 uses the .obj extension for scrubbed application/octet-stream MIME parts. (no CVSS)
- [CVE-2020-12063](https://cve.now/CVE-2020-12063.md): A certain Postfix 2.10.1-7 package could allow an attacker to send an email from an arbitrary-looking sender via a homoglyph attack, as demo (no CVSS)
- [CVE-2020-12135](https://cve.now/CVE-2020-12135.md): bson before 0.8 incorrectly uses int rather than size\_t for many variables, parameters, and return values. (no CVSS)
- [CVE-2020-12134](https://cve.now/CVE-2020-12134.md): Nanometrics Centaur through 4.3.23 and TitanSMA through 4.2.20 mishandle access control for the syslog log. (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2020-04-24
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.