# CVEs published 2020-04-27

86 CVEs were published on April 27, 2020: 1 critical, 10 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2019-15790](https://cve.now/CVE-2019-15790.md): Apport reads PID files with elevated privileges (CVSS 2.8, Canonical Apport)
- [CVE-2020-7640](https://cve.now/CVE-2020-7640.md): pixl-class prior to 1.0.3 allows execution of arbitrary commands. (no CVSS, pixl-class)
- [CVE-2020-9481](https://cve.now/CVE-2020-9481.md): Apache ATS 6.0.0 to 6.2.3, 7.0.0 to 7.1.9, and 8.0.0 to 8.0.6 is vulnerable to a HTTP/2 slow read attack. (no CVSS, Apache ATS)
- [CVE-2020-7609](https://cve.now/CVE-2020-7609.md): node-rules including 3.0.0 and prior to 5.0.0 allows injection of arbitrary commands. (no CVSS, node-rules)
- [CVE-2020-1722](https://cve.now/CVE-2020-1722.md): A flaw was found in all ipa versions 4.x.x through 4.8.0. (CVSS 5.3, Red Hat ipa)
- [CVE-2020-1762](https://cve.now/CVE-2020-1762.md): An insufficient JWT validation vulnerability was found in Kiali versions 0.4.0 to 1.15.0 and was fixed in Kiali version 1.15.1, wherein a re (CVSS 7.0, \[Kiali\] kiali · github.com/kiali/kiali)
- [CVE-2020-7067](https://cve.now/CVE-2020-7067.md): OOB Read in urldecode() (CVSS 7.5, PHP Group PHP)
- [CVE-2018-21180](https://cve.now/CVE-2018-21180.md): Certain NETGEAR devices are affected by a stack-based buffer overflow by an authenticated user. (CVSS 6.8)
- [CVE-2018-21179](https://cve.now/CVE-2018-21179.md): Certain NETGEAR devices are affected by a stack-based buffer overflow by an authenticated user. (CVSS 6.8)
- [CVE-2018-21178](https://cve.now/CVE-2018-21178.md): Certain NETGEAR devices are affected by a stack-based buffer overflow by an authenticated user. (CVSS 6.8)
- [CVE-2019-5303](https://cve.now/CVE-2019-5303.md): There are two denial of service vulnerabilities on some Huawei smartphones. (no CVSS, Huawei ALP-AL00B · Huawei ALP-L09 +36)
- [CVE-2019-5302](https://cve.now/CVE-2019-5302.md): There are two denial of service vulnerabilities on some Huawei smartphones. (no CVSS, Huawei Sydney-L21 · Huawei Sydney-L21BR +35)
- [CVE-2018-21177](https://cve.now/CVE-2018-21177.md): Certain NETGEAR devices are affected by a stack-based buffer overflow by an authenticated user. (CVSS 6.8)
- [CVE-2018-21176](https://cve.now/CVE-2018-21176.md): Certain NETGEAR devices are affected by a stack-based buffer overflow by an authenticated user. (CVSS 6.8)
- [CVE-2018-21175](https://cve.now/CVE-2018-21175.md): Certain NETGEAR devices are affected by a stack-based buffer overflow by an authenticated user. (CVSS 6.8)
- [CVE-2020-11869](https://cve.now/CVE-2020-11869.md): An integer overflow was found in QEMU 4.0.1 through 4.2.0 in the way it implemented ATI VGA emulation. (no CVSS)
- [CVE-2018-21174](https://cve.now/CVE-2018-21174.md): Certain NETGEAR devices are affected by a stack-based buffer overflow by an authenticated user. (CVSS 6.8)
- [CVE-2018-21173](https://cve.now/CVE-2018-21173.md): Certain NETGEAR devices are affected by a stack-based buffer overflow by an authenticated user. (CVSS 6.8)
- [CVE-2018-21172](https://cve.now/CVE-2018-21172.md): Certain NETGEAR devices are affected by a stack-based buffer overflow by an authenticated user. (CVSS 6.8)
- [CVE-2018-21171](https://cve.now/CVE-2018-21171.md): Certain NETGEAR devices are affected by a stack-based buffer overflow by an authenticated user. (CVSS 6.8)
- [CVE-2018-21170](https://cve.now/CVE-2018-21170.md): Certain NETGEAR devices are affected by a stack-based buffer overflow by an unauthenticated attacker. (CVSS 8.8)
- [CVE-2018-21169](https://cve.now/CVE-2018-21169.md): Certain NETGEAR devices are affected by incorrect configuration of security settings. (CVSS 8.8)
- [CVE-2018-21168](https://cve.now/CVE-2018-21168.md): Certain NETGEAR devices are affected by disclosure of sensitive information. (CVSS 6.5)
- [CVE-2018-21167](https://cve.now/CVE-2018-21167.md): Certain NETGEAR devices are affected by stored XSS. (CVSS 4.8)
- [CVE-2018-21159](https://cve.now/CVE-2018-21159.md): NETGEAR ReadyNAS devices before 6.9.3 are affected by incorrect configuration of security settings. (CVSS 4.5)
- [CVE-2018-21158](https://cve.now/CVE-2018-21158.md): NETGEAR R7800 devices before 1.0.2.46 are affected by incorrect configuration of security settings. (CVSS 8.8)
- [CVE-2018-21157](https://cve.now/CVE-2018-21157.md): Certain NETGEAR devices are affected by command injection by an authenticated user. (CVSS 6.8)
- [CVE-2018-21156](https://cve.now/CVE-2018-21156.md): Certain NETGEAR devices are affected by a buffer overflow by an authenticated user. (CVSS 6.8)
- [CVE-2018-21155](https://cve.now/CVE-2018-21155.md): Certain NETGEAR devices are affected by stored XSS. (CVSS 6.3)
- [CVE-2018-21154](https://cve.now/CVE-2018-21154.md): Certain NETGEAR devices are affected by command injection by an authenticated user. (CVSS 6.8)
- [CVE-2018-21153](https://cve.now/CVE-2018-21153.md): Certain NETGEAR devices are affected by a buffer overflow by an unauthenticated attacker. (CVSS 8.8)
- [CVE-2018-21152](https://cve.now/CVE-2018-21152.md): Certain NETGEAR devices are affected by command injection by an authenticated user. (CVSS 6.8)
- [CVE-2018-21149](https://cve.now/CVE-2018-21149.md): Certain NETGEAR devices are affected by a stack-based buffer overflow by an authenticated user. (CVSS 6.8)
- [CVE-2018-21100](https://cve.now/CVE-2018-21100.md): NETGEAR R7800 devices before 1.0.2.60 are affected by command injection by an authenticated user. (CVSS 7.6)
- [CVE-2018-21099](https://cve.now/CVE-2018-21099.md): NETGEAR R7800 devices before 1.0.2.60 are affected by command injection by an authenticated user. (CVSS 7.6)
- [CVE-2018-21098](https://cve.now/CVE-2018-21098.md): NETGEAR R7800 devices before 1.0.2.60 are affected by command injection by an authenticated user. (CVSS 6.8)
- [CVE-2020-11941](https://cve.now/CVE-2020-11941.md): An issue was discovered in Open-AudIT 3.2.2. (no CVSS)
- [CVE-2020-9294](https://cve.now/CVE-2020-9294.md): An improper authentication vulnerability in FortiMail 5.4.10, 6.0.7, 6.2.2 and earlier and FortiVoiceEntreprise 6.0.0 and 6.0.1 may allow a (no CVSS, Fortinet FortiMail · Fortinet FortiVoiceEnterprise)
- [CVE-2020-1952](https://cve.now/CVE-2020-1952.md): An issue was found in Apache IoTDB .9.0 to 0.9.1 and 0.8.0 to 0.8.2. (no CVSS, Apache IoTDB · org.apache.iotdb:iotdb-parent)
- [CVE-2019-15234](https://cve.now/CVE-2019-15234.md): SHAREit through 4.0.6.177 does not check the full message length from the received packet header (which is used to allocate memory for the n (no CVSS)
- [CVE-2019-14941](https://cve.now/CVE-2019-14941.md): SHAREit through 4.0.6.177 does not check the body length from the received packet header (which is used to allocate memory for the next set (no CVSS)
- [CVE-2018-21097](https://cve.now/CVE-2018-21097.md): Certain NETGEAR devices are affected by a stack-based buffer overflow by an unauthenticated attacker. (CVSS 7.1)
- [CVE-2018-21096](https://cve.now/CVE-2018-21096.md): Certain NETGEAR devices are affected by CSRF. (CVSS 5.2)
- [CVE-2018-21095](https://cve.now/CVE-2018-21095.md): Certain NETGEAR devices are affected by stored XSS. (CVSS 4.3)
- [CVE-2020-9488](https://cve.now/CVE-2020-9488.md): Improper validation of certificate with host mismatch in Apache Log4j SMTP appender. (CVSS 3.7, Apache Log4j · org.apache.logging.log4j:log4j +1)
- [CVE-2020-9068](https://cve.now/CVE-2020-9068.md): Huawei AR3200 products with versions of V200R007C00SPC900, V200R007C00SPCa00, V200R007C00SPCb00, V200R007C00SPCc00, V200R009C00SPC500 have a (no CVSS, Huawei AR3200)
- [CVE-2020-1880](https://cve.now/CVE-2020-1880.md): Huawei smartphone Lion-AL00C with versions earlier than 10.0.0.205(C00E202R7P2) have a denial of service vulnerability. (no CVSS, Huawei Lion-AL00C)
- [CVE-2020-12242](https://cve.now/CVE-2020-12242.md): Valve Source allows local users to gain privileges by writing to the /tmp/hl2\_relaunch file, which is later executed in the context of a dif (no CVSS)
- [CVE-2020-1806](https://cve.now/CVE-2020-1806.md): Huawei Honor V10 smartphones with versions earlier than 10.0.0.156(C00E156R2P4) has three out of bounds vulnerabilities. (no CVSS, Huawei Honor)
- [CVE-2020-1805](https://cve.now/CVE-2020-1805.md): Huawei Honor V10 smartphones with versions earlier than 10.0.0.156(C00E156R2P4) has three out of bounds vulnerabilities. (no CVSS, Huawei Honor)
- [CVE-2020-1804](https://cve.now/CVE-2020-1804.md): Huawei Honor V10 smartphones with versions earlier than 10.0.0.156(C00E156R2P4) has three out of bounds vulnerabilities. (no CVSS, Huawei Honor)
- [CVE-2020-11810](https://cve.now/CVE-2020-11810.md): An issue was discovered in OpenVPN 2.4.x before 2.4.9. (no CVSS)
- [CVE-2018-21094](https://cve.now/CVE-2018-21094.md): Certain NETGEAR devices are affected by incorrect configuration of security settings. (CVSS 7.3)
- [CVE-2018-21093](https://cve.now/CVE-2018-21093.md): Certain NETGEAR devices are affected by a stack-based buffer overflow by an unauthenticated attacker. (CVSS 6.4)
- [CVE-2020-11415](https://cve.now/CVE-2020-11415.md): An issue was discovered in Sonatype Nexus Repository Manager 2.x before 2.14.17 and 3.x before 3.22.1. (no CVSS)
- [CVE-2020-9072](https://cve.now/CVE-2020-9072.md): Huawei OSD product with versions earlier than OSD\_uwp\_9.0.32.0 have a local privilege escalation vulnerability. (no CVSS, Huawei OSD)
- [CVE-2020-12266](https://cve.now/CVE-2020-12266.md): An issue was discovered where there are multiple externally accessible pages that do not require any sort of authentication, and store syste (no CVSS)
- [CVE-2020-12138](https://cve.now/CVE-2020-12138.md): AMD ATI atillk64.sys 5.11.9.0 allows low-privileged users to interact directly with physical memory by calling one of several driver routine (no CVSS)
- [CVE-2020-1807](https://cve.now/CVE-2020-1807.md): HUAWEI Mate 20 smartphones with versions earlier than 10.0.0.188(C00E74R3P8) have an improper authorization vulnerability. (no CVSS, HUAWEI Mate)
- [CVE-2019-20002](https://cve.now/CVE-2019-20002.md): Formula Injection exists in the export feature in SolarWinds WebHelpDesk 12.7.1 via a value (provided by a low-privileged user in the Subjec (no CVSS)
- [CVE-2020-1845](https://cve.now/CVE-2020-1845.md): Huawei PCManager product with versions earlier than 10.0.5.53 have a local privilege escalation vulnerability. (no CVSS, Huawei PCManager)
- [CVE-2020-12133](https://cve.now/CVE-2020-12133.md): The Apros Evolution, ConsciusMap, and Furukawa provisioning systems through 2.8.1 allow remote code execution because of javax.faces.ViewSta (no CVSS)
- [CVE-2020-11822](https://cve.now/CVE-2020-11822.md): In Rukovoditel 2.5.2, there is a stored XSS vulnerability on the application structure --\> user access groups page. (no CVSS)
- [CVE-2020-12120](https://cve.now/CVE-2020-12120.md): The Correos Express addon for PrestaShop 1.6 through 1.7 allows remote attackers to obtain sensitive information, such as a service's owner (no CVSS)
- [CVE-2020-11821](https://cve.now/CVE-2020-11821.md): In Rukovoditel 2.5.2, users' passwords and usernames are stored in a cookie with URL encoding, base64 encoding, and hashing. (no CVSS)
- [CVE-2020-7135](https://cve.now/CVE-2020-7135.md): A potential security vulnerability has been identified in the disk drive firmware installers named Supplemental Update / Online ROM Flash Co (no CVSS, HPE Service Pack for ProLiant · HPE Server Solid State D… +6)
- [CVE-2020-11817](https://cve.now/CVE-2020-11817.md): In Rukovoditel V2.5.2, attackers can upload an arbitrary file to the server just changing the the content-type value. (no CVSS)
- [CVE-2019-18823](https://cve.now/CVE-2019-18823.md): HTCondor up to and including stable series 8.8.6 and development series 8.9.4 has Incorrect Access Control. (no CVSS)
- [CVE-2019-20790](https://cve.now/CVE-2019-20790.md): OpenDMARC through 1.3.2 and 1.4.x, when used with pypolicyd-spf 2.0.2, allows attacks that bypass SPF and DMARC authentication in situations (no CVSS)
- [CVE-2020-9489](https://cve.now/CVE-2020-9489.md): A carefully crafted or corrupt file may trigger a System.exit in Tika's OneNote Parser. (no CVSS, The Apache Software Foundation Apache Tika · org.apache.tik…)
- [CVE-2019-4729](https://cve.now/CVE-2019-4729.md): IBM Cognos Analytics 11.0 and 11.1 could allow a remote attacker to obtain sensitive information when a detailed technical error message is (CVSS 4.3, IBM Cognos Analytics)
- [CVE-2020-11420](https://cve.now/CVE-2020-11420.md): UPS Adapter CS141 before 1.90 allows Directory Traversal. (no CVSS)
- [CVE-2019-18223](https://cve.now/CVE-2019-18223.md): ZOOM International Call Recording 6.3.1 suffers from multiple authenticated stored XSS vulnerabilities via the phoneNumber field in the (1) (no CVSS)
- [CVE-2020-10996](https://cve.now/CVE-2020-10996.md): An issue was discovered in Percona XtraDB Cluster before 5.7.28-31.41.2. (no CVSS)
- [CVE-2020-10997](https://cve.now/CVE-2020-10997.md): Percona XtraBackup before 2.4.20 unintentionally writes the command line to any resulting backup file output. (no CVSS)
- [CVE-2020-12273](https://cve.now/CVE-2020-12273.md): In TestLink 1.9.20, a crafted login.php viewer parameter exposes cleartext credentials. (no CVSS)
- [CVE-2020-12274](https://cve.now/CVE-2020-12274.md): In TestLink 1.9.20, the lib/cfields/cfieldsExport.php goback\_url parameter causes a security risk because it depends on client input and is (no CVSS)
- [CVE-2020-12052](https://cve.now/CVE-2020-12052.md): Grafana version \< 6.7.3 is vulnerable for annotation popup XSS. (no CVSS)
- [CVE-2020-10664](https://cve.now/CVE-2020-10664.md): The IGMP component in VxWorks 6.8.3 IPNET CVE patches created in 2019 has a NULL Pointer Dereference. (no CVSS)
- [CVE-2020-12271](https://cve.now/CVE-2020-12271.md): A SQL injection issue was found in SFOS 17.0, 17.1, 17.5, and 18.0 before 2020-04-25 on Sophos XG Firewall devices, as exploited in the wild (CVSS 10.0, KEV)
- [CVE-2020-12270](https://cve.now/CVE-2020-12270.md): React Native Bluetooth Scan in Bluezone 1.0.0 uses six-character alphanumeric IDs, which might make it easier for remote attackers to interf (no CVSS)
- [CVE-2020-12268](https://cve.now/CVE-2020-12268.md): jbig2\_image\_compose in jbig2\_image.c in Artifex jbig2dec before 0.18 has a heap-based buffer overflow. (no CVSS)
- [CVE-2020-12267](https://cve.now/CVE-2020-12267.md): setMarkdown in Qt before 5.14.2 has a use-after-free related to QTextMarkdownImporter::insertBlock. (no CVSS)
- [CVE-2020-12272](https://cve.now/CVE-2020-12272.md): OpenDMARC through 1.3.2 and 1.4.x allows attacks that inject authentication results to provide false information about the domain that origi (no CVSS)
- [CVE-2020-12278](https://cve.now/CVE-2020-12278.md): An issue was discovered in libgit2 before 0.28.4 and 0.9x before 0.99.0. (no CVSS)
- [CVE-2020-12279](https://cve.now/CVE-2020-12279.md): An issue was discovered in libgit2 before 0.28.4 and 0.9x before 0.99.0. (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2020-04-27
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.