CVEs published April 27, 2020
86 CVEs were published on April 27, 2020: 1 critical, 10 high. 1 is now in CISA KEV.
- Published
- 86
- Critical
- 1
- High
- 10
- Medium
- 25
- Low
- 2
- Unrated
- 48
- Now in CISA KEV
- 1
- Fix available
- 7
Most affected products
- Huawei Honor
- 3
- [Kiali] kiali · github.com/kiali/kiali
- 1
- Apache ATS
- 1
- Apache IoTDB · org.apache.iotdb:iotdb-parent
- 1
- Apache Log4j · org.apache.logging.log4j:log4j +1
- 1
- Canonical Apport
- 1
- Fortinet FortiMail · Fortinet FortiVoiceEnterprise
- 1
- HPE Service Pack for ProLiant · HPE Server Solid State D… +6
- 1
- Huawei ALP-AL00B · Huawei ALP-L09 +36
- 1
- Huawei AR3200
- 1
Critical 1
High 10
- CVE-2020-1762An insufficient JWT validation vulnerability was found in Kiali versions 0.4.0 to 1.15.0 and was fixed in Kiali version 1.15.1, wherein a re[Kiali] kiali · github.com/kiali/kiali
- CVE-2020-7067OOB Read in urldecode()PHP Group PHP
- CVE-2018-21170Certain NETGEAR devices are affected by a stack-based buffer overflow by an unauthenticated attacker.
- CVE-2018-21169Certain NETGEAR devices are affected by incorrect configuration of security settings.
- CVE-2018-21158NETGEAR R7800 devices before 1.0.2.46 are affected by incorrect configuration of security settings.
- CVE-2018-21153Certain NETGEAR devices are affected by a buffer overflow by an unauthenticated attacker.
- CVE-2018-21100NETGEAR R7800 devices before 1.0.2.60 are affected by command injection by an authenticated user.
- CVE-2018-21099NETGEAR R7800 devices before 1.0.2.60 are affected by command injection by an authenticated user.
- CVE-2018-21097Certain NETGEAR devices are affected by a stack-based buffer overflow by an unauthenticated attacker.
- CVE-2018-21094Certain NETGEAR devices are affected by incorrect configuration of security settings.
Medium, low and unrated 75
- CVE-2019-15790Apport reads PID files with elevated privilegesCanonical Apport
- CVE-2020-7640pixl-class prior to 1.0.3 allows execution of arbitrary commands.pixl-class
- CVE-2020-9481Apache ATS 6.0.0 to 6.2.3, 7.0.0 to 7.1.9, and 8.0.0 to 8.0.6 is vulnerable to a HTTP/2 slow read attack.Apache ATS
- CVE-2020-7609node-rules including 3.0.0 and prior to 5.0.0 allows injection of arbitrary commands.node-rules
- CVE-2020-1722A flaw was found in all ipa versions 4.x.x through 4.8.0.Red Hat ipa
- CVE-2018-21180Certain NETGEAR devices are affected by a stack-based buffer overflow by an authenticated user.
- CVE-2018-21179Certain NETGEAR devices are affected by a stack-based buffer overflow by an authenticated user.
- CVE-2018-21178Certain NETGEAR devices are affected by a stack-based buffer overflow by an authenticated user.
- CVE-2019-5303There are two denial of service vulnerabilities on some Huawei smartphones.Huawei ALP-AL00B · Huawei ALP-L09 +36
- CVE-2019-5302There are two denial of service vulnerabilities on some Huawei smartphones.Huawei Sydney-L21 · Huawei Sydney-L21BR +35
- CVE-2018-21177Certain NETGEAR devices are affected by a stack-based buffer overflow by an authenticated user.
- CVE-2018-21176Certain NETGEAR devices are affected by a stack-based buffer overflow by an authenticated user.
- CVE-2018-21175Certain NETGEAR devices are affected by a stack-based buffer overflow by an authenticated user.
- CVE-2020-11869An integer overflow was found in QEMU 4.0.1 through 4.2.0 in the way it implemented ATI VGA emulation.
- CVE-2018-21174Certain NETGEAR devices are affected by a stack-based buffer overflow by an authenticated user.
- CVE-2018-21173Certain NETGEAR devices are affected by a stack-based buffer overflow by an authenticated user.
- CVE-2018-21172Certain NETGEAR devices are affected by a stack-based buffer overflow by an authenticated user.
- CVE-2018-21171Certain NETGEAR devices are affected by a stack-based buffer overflow by an authenticated user.
- CVE-2018-21168Certain NETGEAR devices are affected by disclosure of sensitive information.
- CVE-2018-21167Certain NETGEAR devices are affected by stored XSS.
- CVE-2018-21159NETGEAR ReadyNAS devices before 6.9.3 are affected by incorrect configuration of security settings.
- CVE-2018-21157Certain NETGEAR devices are affected by command injection by an authenticated user.
- CVE-2018-21156Certain NETGEAR devices are affected by a buffer overflow by an authenticated user.
- CVE-2018-21155Certain NETGEAR devices are affected by stored XSS.
- CVE-2018-21154Certain NETGEAR devices are affected by command injection by an authenticated user.
- CVE-2018-21152Certain NETGEAR devices are affected by command injection by an authenticated user.
- CVE-2018-21149Certain NETGEAR devices are affected by a stack-based buffer overflow by an authenticated user.
- CVE-2018-21098NETGEAR R7800 devices before 1.0.2.60 are affected by command injection by an authenticated user.
- CVE-2020-11941An issue was discovered in Open-AudIT 3.2.2.
- CVE-2020-9294An improper authentication vulnerability in FortiMail 5.4.10, 6.0.7, 6.2.2 and earlier and FortiVoiceEntreprise 6.0.0 and 6.0.1 may allow a Fortinet FortiMail · Fortinet FortiVoiceEnterprise
- CVE-2020-1952An issue was found in Apache IoTDB .9.0 to 0.9.1 and 0.8.0 to 0.8.2.Apache IoTDB · org.apache.iotdb:iotdb-parent
- CVE-2019-15234SHAREit through 4.0.6.177 does not check the full message length from the received packet header (which is used to allocate memory for the n
- CVE-2019-14941SHAREit through 4.0.6.177 does not check the body length from the received packet header (which is used to allocate memory for the next set
- CVE-2018-21096Certain NETGEAR devices are affected by CSRF.
- CVE-2018-21095Certain NETGEAR devices are affected by stored XSS.
- CVE-2020-9488Improper validation of certificate with host mismatch in Apache Log4j SMTP appender.Apache Log4j · org.apache.logging.log4j:log4j +1
- CVE-2020-9068Huawei AR3200 products with versions of V200R007C00SPC900, V200R007C00SPCa00, V200R007C00SPCb00, V200R007C00SPCc00, V200R009C00SPC500 have aHuawei AR3200
- CVE-2020-1880Huawei smartphone Lion-AL00C with versions earlier than 10.0.0.205(C00E202R7P2) have a denial of service vulnerability.Huawei Lion-AL00C
- CVE-2020-12242Valve Source allows local users to gain privileges by writing to the /tmp/hl2_relaunch file, which is later executed in the context of a dif
- CVE-2020-1806Huawei Honor V10 smartphones with versions earlier than 10.0.0.156(C00E156R2P4) has three out of bounds vulnerabilities.Huawei Honor
- CVE-2020-1805Huawei Honor V10 smartphones with versions earlier than 10.0.0.156(C00E156R2P4) has three out of bounds vulnerabilities.Huawei Honor
- CVE-2020-1804Huawei Honor V10 smartphones with versions earlier than 10.0.0.156(C00E156R2P4) has three out of bounds vulnerabilities.Huawei Honor
- CVE-2020-11810An issue was discovered in OpenVPN 2.4.x before 2.4.9.
- CVE-2018-21093Certain NETGEAR devices are affected by a stack-based buffer overflow by an unauthenticated attacker.
- CVE-2020-11415An issue was discovered in Sonatype Nexus Repository Manager 2.x before 2.14.17 and 3.x before 3.22.1.
- CVE-2020-9072Huawei OSD product with versions earlier than OSD_uwp_9.0.32.0 have a local privilege escalation vulnerability.Huawei OSD
- CVE-2020-12266An issue was discovered where there are multiple externally accessible pages that do not require any sort of authentication, and store syste
- CVE-2020-12138AMD ATI atillk64.sys 5.11.9.0 allows low-privileged users to interact directly with physical memory by calling one of several driver routine
- CVE-2020-1807HUAWEI Mate 20 smartphones with versions earlier than 10.0.0.188(C00E74R3P8) have an improper authorization vulnerability.HUAWEI Mate
- CVE-2019-20002Formula Injection exists in the export feature in SolarWinds WebHelpDesk 12.7.1 via a value (provided by a low-privileged user in the Subjec
- CVE-2020-1845Huawei PCManager product with versions earlier than 10.0.5.53 have a local privilege escalation vulnerability.Huawei PCManager
- CVE-2020-12133The Apros Evolution, ConsciusMap, and Furukawa provisioning systems through 2.8.1 allow remote code execution because of javax.faces.ViewSta
- CVE-2020-11822In Rukovoditel 2.5.2, there is a stored XSS vulnerability on the application structure --> user access groups page.
- CVE-2020-12120The Correos Express addon for PrestaShop 1.6 through 1.7 allows remote attackers to obtain sensitive information, such as a service's owner
- CVE-2020-11821In Rukovoditel 2.5.2, users' passwords and usernames are stored in a cookie with URL encoding, base64 encoding, and hashing.
- CVE-2020-7135A potential security vulnerability has been identified in the disk drive firmware installers named Supplemental Update / Online ROM Flash CoHPE Service Pack for ProLiant · HPE Server Solid State D… +6
- CVE-2020-11817In Rukovoditel V2.5.2, attackers can upload an arbitrary file to the server just changing the the content-type value.
- CVE-2019-18823HTCondor up to and including stable series 8.8.6 and development series 8.9.4 has Incorrect Access Control.
- CVE-2019-20790OpenDMARC through 1.3.2 and 1.4.x, when used with pypolicyd-spf 2.0.2, allows attacks that bypass SPF and DMARC authentication in situations
- CVE-2020-9489A carefully crafted or corrupt file may trigger a System.exit in Tika's OneNote Parser.The Apache Software Foundation Apache Tika · org.apache.tik…
- CVE-2019-4729IBM Cognos Analytics 11.0 and 11.1 could allow a remote attacker to obtain sensitive information when a detailed technical error message is IBM Cognos Analytics
- CVE-2020-11420UPS Adapter CS141 before 1.90 allows Directory Traversal.
- CVE-2019-18223ZOOM International Call Recording 6.3.1 suffers from multiple authenticated stored XSS vulnerabilities via the phoneNumber field in the (1)
- CVE-2020-10996An issue was discovered in Percona XtraDB Cluster before 5.7.28-31.41.2.
- CVE-2020-10997Percona XtraBackup before 2.4.20 unintentionally writes the command line to any resulting backup file output.
- CVE-2020-12273In TestLink 1.9.20, a crafted login.php viewer parameter exposes cleartext credentials.
- CVE-2020-12274In TestLink 1.9.20, the lib/cfields/cfieldsExport.php goback_url parameter causes a security risk because it depends on client input and is
- CVE-2020-12052Grafana version < 6.7.3 is vulnerable for annotation popup XSS.
- CVE-2020-10664The IGMP component in VxWorks 6.8.3 IPNET CVE patches created in 2019 has a NULL Pointer Dereference.
- CVE-2020-12270React Native Bluetooth Scan in Bluezone 1.0.0 uses six-character alphanumeric IDs, which might make it easier for remote attackers to interf
- CVE-2020-12268jbig2_image_compose in jbig2_image.c in Artifex jbig2dec before 0.18 has a heap-based buffer overflow.
- CVE-2020-12267setMarkdown in Qt before 5.14.2 has a use-after-free related to QTextMarkdownImporter::insertBlock.
- CVE-2020-12272OpenDMARC through 1.3.2 and 1.4.x allows attacks that inject authentication results to provide false information about the domain that origi
- CVE-2020-12278An issue was discovered in libgit2 before 0.28.4 and 0.9x before 0.99.0.
- CVE-2020-12279An issue was discovered in libgit2 before 0.28.4 and 0.9x before 0.99.0.