CVEs published April 28, 2020
99 CVEs were published on April 28, 2020: 0 critical, 25 high.
- Published
- 99
- Critical
- 0
- High
- 25
- Medium
- 27
- Low
- 0
- Unrated
- 47
- Now in CISA KEV
- 0
- Fix available
- 5
Most affected products
- Cybozu Garoon
- 7
- FreeBSD
- 7
- ABB OPC Server for AC · ABB Control Builder M Profession… +2
- 1
- ABB System 800xA Base
- 1
- Apache NiFi Registry · org.apache.nifi.registry:nifi-regist…
- 1
- fun-map
- 1
- IBM WebSphere Application Server Liberty · IBM WebSphere Ap…
- 1
- Ignition 8 Gateway
- 1
- json
- 1
- NI Consulting CO. Sales Force Assistant
- 1
High 25
- CVE-2020-8473ABB System 800xA Weak File Permissions - ABB System 800xA BaseABB System 800xA Base
- CVE-2018-21226Certain NETGEAR devices are affected by authentication bypass.
- CVE-2018-21224Certain NETGEAR devices are affected by a buffer overflow by an unauthenticated attacker.
- CVE-2018-21223Certain NETGEAR devices are affected by a buffer overflow by an unauthenticated attacker.
- CVE-2018-21222Certain NETGEAR devices are affected by a buffer overflow by an unauthenticated attacker.
- CVE-2018-21221Certain NETGEAR devices are affected by a buffer overflow by an unauthenticated attacker.
- CVE-2018-21220Certain NETGEAR devices are affected by a buffer overflow by an unauthenticated attacker.
- CVE-2018-21219Certain NETGEAR devices are affected by a buffer overflow by an unauthenticated attacker.
- CVE-2018-21218Certain NETGEAR devices are affected by a buffer overflow by an unauthenticated attacker.
- CVE-2018-21217Certain NETGEAR devices are affected by a buffer overflow by an unauthenticated attacker.
- CVE-2018-21216Certain NETGEAR devices are affected by a buffer overflow by an unauthenticated attacker.
- CVE-2018-21215Certain NETGEAR devices are affected by a buffer overflow by an unauthenticated attacker.
- CVE-2018-21214Certain NETGEAR devices are affected by a buffer overflow by an unauthenticated attacker.
- CVE-2018-21213Certain NETGEAR devices are affected by a buffer overflow by an unauthenticated attacker.
- CVE-2018-21212Certain NETGEAR devices are affected by a buffer overflow by an unauthenticated attacker.
- CVE-2018-21211Certain NETGEAR devices are affected by a buffer overflow by an unauthenticated attacker.
- CVE-2018-21210Certain NETGEAR devices are affected by a buffer overflow by an unauthenticated attacker.
- CVE-2018-21208Certain NETGEAR devices are affected by command injection by an unauthenticated attacker.
- CVE-2018-21207Certain NETGEAR devices are affected by a stack-based buffer overflow by an unauthenticated attacker.
- CVE-2018-21206Certain NETGEAR devices are affected by a stack-based buffer overflow by an unauthenticated attacker.
- CVE-2018-21205Certain NETGEAR devices are affected by a stack-based buffer overflow by an unauthenticated attacker.
- CVE-2018-21204Certain NETGEAR devices are affected by a stack-based buffer overflow by an unauthenticated attacker.
- CVE-2018-21203Certain NETGEAR devices are affected by a stack-based buffer overflow by an unauthenticated attacker.
- CVE-2018-21202Certain NETGEAR devices are affected by a stack-based buffer overflow by an unauthenticated attacker.
- CVE-2020-1745A file inclusion vulnerability was found in the AJP connector enabled with a default AJP configuration port of 8009 in Undertow version 2.0.undertow-io undertow · io.undertow:undertow-core
Medium, low and unrated 74
- CVE-2020-8472ABB System 800xA Weak File Permissions - different productsABB OPC Server for AC · ABB Control Builder M Profession… +2
- CVE-2019-5614In FreeBSD 12.1-STABLE before r356035, 12.1-RELEASE before 12.1-RELEASE-p4, 11.3-STABLE before r356036, and 11.3-RELEASE before 11.3-RELEASEFreeBSD
- CVE-2019-15874In FreeBSD 12.1-STABLE before r356035, 12.1-RELEASE before 12.1-RELEASE-p4, 11.3-STABLE before r356036, and 11.3-RELEASE before 11.3-RELEASEFreeBSD
- CVE-2020-7452In FreeBSD 12.1-STABLE before r357490, 12.1-RELEASE before 12.1-RELEASE-p3, 11.3-STABLE before r357489, and 11.3-RELEASE before 11.3-RELEASEFreeBSD
- CVE-2020-7453In FreeBSD 12.1-STABLE before r359021, 12.1-RELEASE before 12.1-RELEASE-p3, 11.3-STABLE before r359020, and 11.3-RELEASE before 11.3-RELEASEFreeBSD
- CVE-2020-12442Ivanti Avalanche 6.3 allows a SQL injection that is vaguely associated with the Apache HTTP Server, aka Bug 683250.
- CVE-2020-12261Open-AudIT 3.3.0 allows an XSS attack after login.
- CVE-2020-12103In Tiny File Manager 2.4.1 there is a vulnerability in the ajax file backup copy functionality which allows authenticated users to create ba
- CVE-2020-12102In Tiny File Manager 2.4.1, there is a Path Traversal vulnerability in the ajax recursive directory listing functionality.
- CVE-2020-10663The JSON gem through 2.2.0 for Ruby, as used in Ruby 2.4 through 2.4.9, 2.5 through 2.5.7, and 2.6 through 2.6.5, has an Unsafe Object Creatjson
- CVE-2020-12438An XSS vulnerability exists in the banners.php page of PHP-Fusion 9.03.50.
- CVE-2020-11014BIP LI01 output reordering may cause malformed SLP MINT transactions in Electron-Cash-SLPsimpleledger Electron-Cash-SLP
- CVE-2020-7451In FreeBSD 12.1-STABLE before r358739, 12.1-RELEASE before 12.1-RELEASE-p3, 11.3-STABLE before r358740, and 11.3-RELEASE before 11.3-RELEASEFreeBSD
- CVE-2019-15876In FreeBSD 12.1-STABLE before r356089, 12.1-RELEASE before 12.1-RELEASE-p3, 11.3-STABLE before r356090, and 11.3-RELEASE before 11.3-RELEASEFreeBSD
- CVE-2019-15877In FreeBSD 12.1-STABLE before r356606 and 12.1-RELEASE before 12.1-RELEASE-p3, driver specific ioctl command handlers in the ixl network driFreeBSD
- CVE-2020-12429Online Course Registration 2.0 has multiple SQL injections that would can lead to a complete database compromise and authentication bypass i
- CVE-2020-7644fun-map through 3.3.1 is vulnerable to Prototype Pollution.fun-map
- CVE-2020-10641An unprotected logging route may allow an attacker to write endless log statements into the database without space limits or authentication.Ignition 8 Gateway
- CVE-2020-9482If NiFi Registry 0.1.0 to 0.5.0 uses an authentication mechanism other than PKI, when the user clicks Log Out, NiFi Registry invalidates theApache NiFi Registry · org.apache.nifi.registry:nifi-regist…
- CVE-2020-12243In filter.c in slapd in OpenLDAP before 2.4.50, LDAP search filters with nested boolean expressions can result in denial of service (daemon openldap
- CVE-2019-20791OpenThread before 2019-12-13 has a stack-based buffer overflow in MeshCoP::Commissioner::GeneratePskc.
- CVE-2017-18859Certain NETGEAR devices are affected by slowdown/stoppage.
- CVE-2017-18858Certain NETGEAR devices are affected by command execution.
- CVE-2017-18857The NETGEAR Insight application before 2.42 for Android and iOS is affected by password mismanagement.
- CVE-2018-21225Certain NETGEAR devices are affected by command injection by an authenticated user.
- CVE-2016-11059Certain NETGEAR devices are affected by password exposure.
- CVE-2016-11060Certain NETGEAR devices are affected by insecure renegotiation.
- CVE-2016-11058The NETGEAR genie application before 2.4.34 for Android is affected by mishandling of hard-coded API keys and session IDs.
- CVE-2016-11057Certain NETGEAR devices are affected by mishandling of repeated URL calls.
- CVE-2016-11056Certain NETGEAR devices are affected by anonymous root access.
- CVE-2016-11055Certain NETGEAR devices are affected by CSRF.
- CVE-2016-11054NETGEAR DGN2200v4 devices before 2017-01-06 are affected by command execution and an FTP insecure root directory.
- CVE-2017-18863Certain NETGEAR devices are affected by command execution via a PHP form.
- CVE-2017-18862Certain NETGEAR devices are affected by authentication bypass.
- CVE-2017-18861Certain NETGEAR devices are affected by CSRF.
- CVE-2018-21209Certain NETGEAR devices are affected by reflected XSS.
- CVE-2018-21201Certain NETGEAR devices are affected by a stack-based buffer overflow by an authenticated user.
- CVE-2018-21200Certain NETGEAR devices are affected by a stack-based buffer overflow by an authenticated user.
- CVE-2018-21199Certain NETGEAR devices are affected by a stack-based buffer overflow by an authenticated user.
- CVE-2018-21198Certain NETGEAR devices are affected by a stack-based buffer overflow by an authenticated user.
- CVE-2018-21197Certain NETGEAR devices are affected by a stack-based buffer overflow by an authenticated user.
- CVE-2018-21196Certain NETGEAR devices are affected by a stack-based buffer overflow by an authenticated user.
- CVE-2018-21195Certain NETGEAR devices are affected by a stack-based buffer overflow by an authenticated user.
- CVE-2018-21194Certain NETGEAR devices are affected by a stack-based buffer overflow by an authenticated user.
- CVE-2018-21193Certain NETGEAR devices are affected by a stack-based buffer overflow by an authenticated user.
- CVE-2018-21192Certain NETGEAR devices are affected by a stack-based buffer overflow by an authenticated user.
- CVE-2018-21191Certain NETGEAR devices are affected by a stack-based buffer overflow by an authenticated user.
- CVE-2018-21190Certain NETGEAR devices are affected by a stack-based buffer overflow by an authenticated user.
- CVE-2018-21189Certain NETGEAR devices are affected by a stack-based buffer overflow by an authenticated user.
- CVE-2018-21188Certain NETGEAR devices are affected by a stack-based buffer overflow by an authenticated user.
- CVE-2018-21187Certain NETGEAR devices are affected by a stack-based buffer overflow by an authenticated user.
- CVE-2018-21186Certain NETGEAR devices are affected by a stack-based buffer overflow by an authenticated user.
- CVE-2020-1774Information disclosureOTRS AG ((OTRS)) Community Edition · OTRS AG OTRS
- CVE-2020-4329IBM WebSphere Application Server 7.0, 8.0, 8.5, 9.0 and Liberty 17.0.0.3 through 20.0.0.4 could allow a remote, authenticated attacker to obIBM WebSphere Application Server Liberty · IBM WebSphere Ap…
- CVE-2020-10944HashiCorp Nomad and Nomad Enterprise up to 0.10.4 contained a cross-site scripting vulnerability such that files from a malicious workload c
- CVE-2020-12078An issue was discovered in Open-AudIT 3.3.1.
- CVE-2020-10093A cross-site scripting (XSS) vulnerability in Lexmark Pro910 series inkjet and other discontinued products.
- CVE-2020-10094A cross-site scripting (XSS) vulnerability in Lexmark CS31x before LW74.VYL.P273; CS41x before LW74.VY2.P273; CS51x before LW74.VY4.P273; CX
- CVE-2018-21185Certain NETGEAR devices are affected by a stack-based buffer overflow by an authenticated user.
- CVE-2018-21184Certain NETGEAR devices are affected by a stack-based buffer overflow by an authenticated user.
- CVE-2018-21183Certain NETGEAR devices are affected by a stack-based buffer overflow by an authenticated user.
- CVE-2018-21182Certain NETGEAR devices are affected by a stack-based buffer overflow by an authenticated user.
- CVE-2018-21181Certain NETGEAR devices are affected by a stack-based buffer overflow by an authenticated user.
- CVE-2020-12286In Octopus Deploy before 2019.12.9 and 2020 before 2020.1.12, the TaskView permission is not scoped to any dimension.
- CVE-2020-5570Cross-site scripting vulnerability in Sales Force Assistant version 11.2.48 and earlier allows remote authenticated attackers to inject arbiNI Consulting CO. Sales Force Assistant
- CVE-2020-12284cbs_jpeg_split_fragment in libavcodec/cbs_jpeg.c in FFmpeg 4.1 and 4.2.2 has a heap-based buffer overflow during JPEG_MARKER_SOS handling be
- CVE-2020-5568Cross-site scripting vulnerability in Cybozu Garoon 4.6.0 to 5.0.0 allows remote attackers to inject arbitrary web script or HTML via the apCybozu Garoon
- CVE-2020-5566Improper authorization vulnerability in Cybozu Garoon 4.0.0 to 4.10.3 allows remote authenticated attackers to alter the application's data Cybozu Garoon
- CVE-2020-5567Improper authentication vulnerability in Cybozu Garoon 4.0.0 to 4.10.3 allows remote attackers to obtain data in Application Menu.Cybozu Garoon
- CVE-2020-5564Cross-site scripting vulnerability in Cybozu Garoon 4.0.0 to 4.10.3 allows remote attackers to inject arbitrary web script or HTML via the aCybozu Garoon
- CVE-2020-5565Improper input validation vulnerability in Cybozu Garoon 4.0.0 to 4.10.3 allows a remote authenticated attacker to alter the application's dCybozu Garoon
- CVE-2020-5562Server-side request forgery (SSRF) vulnerability in Cybozu Garoon 4.6.0 to 4.6.3 allows a remote attacker with an administrative privilege tCybozu Garoon
- CVE-2020-5563Improper authentication vulnerability in Cybozu Garoon 4.0.0 to 4.10.3 allows remote attackers to obtain data in the affected product via thCybozu Garoon
- CVE-2020-12430An issue was discovered in qemuDomainGetStatsIOThread in qemu/qemu_driver.c in libvirt 4.10.0 though 6.x before 6.1.0.