# CVEs published 2020-04-28

99 CVEs were published on April 28, 2020: 0 critical, 25 high. Days are UTC.

- [CVE-2020-8473](https://cve.now/CVE-2020-8473.md): ABB System 800xA Weak File Permissions - ABB System 800xA Base (CVSS 7.3, ABB System 800xA Base)
- [CVE-2020-8472](https://cve.now/CVE-2020-8472.md): ABB System 800xA Weak File Permissions - different products (CVSS 5.5, ABB OPC Server for AC · ABB Control Builder M Profession… +2)
- [CVE-2019-5614](https://cve.now/CVE-2019-5614.md): In FreeBSD 12.1-STABLE before r356035, 12.1-RELEASE before 12.1-RELEASE-p4, 11.3-STABLE before r356036, and 11.3-RELEASE before 11.3-RELEASE (no CVSS, FreeBSD)
- [CVE-2019-15874](https://cve.now/CVE-2019-15874.md): In FreeBSD 12.1-STABLE before r356035, 12.1-RELEASE before 12.1-RELEASE-p4, 11.3-STABLE before r356036, and 11.3-RELEASE before 11.3-RELEASE (no CVSS, FreeBSD)
- [CVE-2020-7452](https://cve.now/CVE-2020-7452.md): In FreeBSD 12.1-STABLE before r357490, 12.1-RELEASE before 12.1-RELEASE-p3, 11.3-STABLE before r357489, and 11.3-RELEASE before 11.3-RELEASE (no CVSS, FreeBSD)
- [CVE-2020-7453](https://cve.now/CVE-2020-7453.md): In FreeBSD 12.1-STABLE before r359021, 12.1-RELEASE before 12.1-RELEASE-p3, 11.3-STABLE before r359020, and 11.3-RELEASE before 11.3-RELEASE (no CVSS, FreeBSD)
- [CVE-2020-12442](https://cve.now/CVE-2020-12442.md): Ivanti Avalanche 6.3 allows a SQL injection that is vaguely associated with the Apache HTTP Server, aka Bug 683250. (no CVSS)
- [CVE-2020-12261](https://cve.now/CVE-2020-12261.md): Open-AudIT 3.3.0 allows an XSS attack after login. (no CVSS)
- [CVE-2020-12103](https://cve.now/CVE-2020-12103.md): In Tiny File Manager 2.4.1 there is a vulnerability in the ajax file backup copy functionality which allows authenticated users to create ba (no CVSS)
- [CVE-2020-12102](https://cve.now/CVE-2020-12102.md): In Tiny File Manager 2.4.1, there is a Path Traversal vulnerability in the ajax recursive directory listing functionality. (no CVSS)
- [CVE-2020-10663](https://cve.now/CVE-2020-10663.md): The JSON gem through 2.2.0 for Ruby, as used in Ruby 2.4 through 2.4.9, 2.5 through 2.5.7, and 2.6 through 2.6.5, has an Unsafe Object Creat (no CVSS, json)
- [CVE-2020-12438](https://cve.now/CVE-2020-12438.md): An XSS vulnerability exists in the banners.php page of PHP-Fusion 9.03.50. (no CVSS)
- [CVE-2020-11014](https://cve.now/CVE-2020-11014.md): BIP LI01 output reordering may cause malformed SLP MINT transactions in Electron-Cash-SLP (CVSS 6.1, simpleledger Electron-Cash-SLP)
- [CVE-2020-7451](https://cve.now/CVE-2020-7451.md): In FreeBSD 12.1-STABLE before r358739, 12.1-RELEASE before 12.1-RELEASE-p3, 11.3-STABLE before r358740, and 11.3-RELEASE before 11.3-RELEASE (no CVSS, FreeBSD)
- [CVE-2019-15876](https://cve.now/CVE-2019-15876.md): In FreeBSD 12.1-STABLE before r356089, 12.1-RELEASE before 12.1-RELEASE-p3, 11.3-STABLE before r356090, and 11.3-RELEASE before 11.3-RELEASE (no CVSS, FreeBSD)
- [CVE-2019-15877](https://cve.now/CVE-2019-15877.md): In FreeBSD 12.1-STABLE before r356606 and 12.1-RELEASE before 12.1-RELEASE-p3, driver specific ioctl command handlers in the ixl network dri (no CVSS, FreeBSD)
- [CVE-2020-12429](https://cve.now/CVE-2020-12429.md): Online Course Registration 2.0 has multiple SQL injections that would can lead to a complete database compromise and authentication bypass i (no CVSS)
- [CVE-2020-7644](https://cve.now/CVE-2020-7644.md): fun-map through 3.3.1 is vulnerable to Prototype Pollution. (no CVSS, fun-map)
- [CVE-2020-10641](https://cve.now/CVE-2020-10641.md): An unprotected logging route may allow an attacker to write endless log statements into the database without space limits or authentication. (no CVSS, Ignition 8 Gateway)
- [CVE-2020-9482](https://cve.now/CVE-2020-9482.md): If NiFi Registry 0.1.0 to 0.5.0 uses an authentication mechanism other than PKI, when the user clicks Log Out, NiFi Registry invalidates the (no CVSS, Apache NiFi Registry · org.apache.nifi.registry:nifi-regist…)
- [CVE-2020-12243](https://cve.now/CVE-2020-12243.md): In filter.c in slapd in OpenLDAP before 2.4.50, LDAP search filters with nested boolean expressions can result in denial of service (daemon (no CVSS, openldap)
- [CVE-2019-20791](https://cve.now/CVE-2019-20791.md): OpenThread before 2019-12-13 has a stack-based buffer overflow in MeshCoP::Commissioner::GeneratePskc. (no CVSS)
- [CVE-2017-18859](https://cve.now/CVE-2017-18859.md): Certain NETGEAR devices are affected by slowdown/stoppage. (no CVSS)
- [CVE-2017-18858](https://cve.now/CVE-2017-18858.md): Certain NETGEAR devices are affected by command execution. (no CVSS)
- [CVE-2017-18857](https://cve.now/CVE-2017-18857.md): The NETGEAR Insight application before 2.42 for Android and iOS is affected by password mismanagement. (no CVSS)
- [CVE-2018-21226](https://cve.now/CVE-2018-21226.md): Certain NETGEAR devices are affected by authentication bypass. (CVSS 8.8)
- [CVE-2018-21225](https://cve.now/CVE-2018-21225.md): Certain NETGEAR devices are affected by command injection by an authenticated user. (CVSS 6.8)
- [CVE-2018-21224](https://cve.now/CVE-2018-21224.md): Certain NETGEAR devices are affected by a buffer overflow by an unauthenticated attacker. (CVSS 8.8)
- [CVE-2018-21223](https://cve.now/CVE-2018-21223.md): Certain NETGEAR devices are affected by a buffer overflow by an unauthenticated attacker. (CVSS 8.8)
- [CVE-2018-21222](https://cve.now/CVE-2018-21222.md): Certain NETGEAR devices are affected by a buffer overflow by an unauthenticated attacker. (CVSS 8.8)
- [CVE-2018-21221](https://cve.now/CVE-2018-21221.md): Certain NETGEAR devices are affected by a buffer overflow by an unauthenticated attacker. (CVSS 8.8)
- [CVE-2016-11059](https://cve.now/CVE-2016-11059.md): Certain NETGEAR devices are affected by password exposure. (no CVSS)
- [CVE-2016-11060](https://cve.now/CVE-2016-11060.md): Certain NETGEAR devices are affected by insecure renegotiation. (no CVSS)
- [CVE-2016-11058](https://cve.now/CVE-2016-11058.md): The NETGEAR genie application before 2.4.34 for Android is affected by mishandling of hard-coded API keys and session IDs. (no CVSS)
- [CVE-2016-11057](https://cve.now/CVE-2016-11057.md): Certain NETGEAR devices are affected by mishandling of repeated URL calls. (no CVSS)
- [CVE-2016-11056](https://cve.now/CVE-2016-11056.md): Certain NETGEAR devices are affected by anonymous root access. (no CVSS)
- [CVE-2016-11055](https://cve.now/CVE-2016-11055.md): Certain NETGEAR devices are affected by CSRF. (no CVSS)
- [CVE-2016-11054](https://cve.now/CVE-2016-11054.md): NETGEAR DGN2200v4 devices before 2017-01-06 are affected by command execution and an FTP insecure root directory. (no CVSS)
- [CVE-2017-18863](https://cve.now/CVE-2017-18863.md): Certain NETGEAR devices are affected by command execution via a PHP form. (no CVSS)
- [CVE-2017-18862](https://cve.now/CVE-2017-18862.md): Certain NETGEAR devices are affected by authentication bypass. (no CVSS)
- [CVE-2017-18861](https://cve.now/CVE-2017-18861.md): Certain NETGEAR devices are affected by CSRF. (no CVSS)
- [CVE-2018-21220](https://cve.now/CVE-2018-21220.md): Certain NETGEAR devices are affected by a buffer overflow by an unauthenticated attacker. (CVSS 8.8)
- [CVE-2018-21219](https://cve.now/CVE-2018-21219.md): Certain NETGEAR devices are affected by a buffer overflow by an unauthenticated attacker. (CVSS 8.8)
- [CVE-2018-21218](https://cve.now/CVE-2018-21218.md): Certain NETGEAR devices are affected by a buffer overflow by an unauthenticated attacker. (CVSS 8.8)
- [CVE-2018-21217](https://cve.now/CVE-2018-21217.md): Certain NETGEAR devices are affected by a buffer overflow by an unauthenticated attacker. (CVSS 8.8)
- [CVE-2018-21216](https://cve.now/CVE-2018-21216.md): Certain NETGEAR devices are affected by a buffer overflow by an unauthenticated attacker. (CVSS 8.8)
- [CVE-2018-21215](https://cve.now/CVE-2018-21215.md): Certain NETGEAR devices are affected by a buffer overflow by an unauthenticated attacker. (CVSS 8.8)
- [CVE-2018-21214](https://cve.now/CVE-2018-21214.md): Certain NETGEAR devices are affected by a buffer overflow by an unauthenticated attacker. (CVSS 8.8)
- [CVE-2018-21213](https://cve.now/CVE-2018-21213.md): Certain NETGEAR devices are affected by a buffer overflow by an unauthenticated attacker. (CVSS 8.8)
- [CVE-2018-21212](https://cve.now/CVE-2018-21212.md): Certain NETGEAR devices are affected by a buffer overflow by an unauthenticated attacker. (CVSS 8.8)
- [CVE-2018-21211](https://cve.now/CVE-2018-21211.md): Certain NETGEAR devices are affected by a buffer overflow by an unauthenticated attacker. (CVSS 8.8)
- [CVE-2018-21210](https://cve.now/CVE-2018-21210.md): Certain NETGEAR devices are affected by a buffer overflow by an unauthenticated attacker. (CVSS 8.8)
- [CVE-2018-21209](https://cve.now/CVE-2018-21209.md): Certain NETGEAR devices are affected by reflected XSS. (CVSS 4.8)
- [CVE-2018-21208](https://cve.now/CVE-2018-21208.md): Certain NETGEAR devices are affected by command injection by an unauthenticated attacker. (CVSS 8.8)
- [CVE-2018-21207](https://cve.now/CVE-2018-21207.md): Certain NETGEAR devices are affected by a stack-based buffer overflow by an unauthenticated attacker. (CVSS 8.8)
- [CVE-2018-21206](https://cve.now/CVE-2018-21206.md): Certain NETGEAR devices are affected by a stack-based buffer overflow by an unauthenticated attacker. (CVSS 8.8)
- [CVE-2018-21205](https://cve.now/CVE-2018-21205.md): Certain NETGEAR devices are affected by a stack-based buffer overflow by an unauthenticated attacker. (CVSS 8.8)
- [CVE-2018-21204](https://cve.now/CVE-2018-21204.md): Certain NETGEAR devices are affected by a stack-based buffer overflow by an unauthenticated attacker. (CVSS 8.8)
- [CVE-2018-21203](https://cve.now/CVE-2018-21203.md): Certain NETGEAR devices are affected by a stack-based buffer overflow by an unauthenticated attacker. (CVSS 8.8)
- [CVE-2018-21202](https://cve.now/CVE-2018-21202.md): Certain NETGEAR devices are affected by a stack-based buffer overflow by an unauthenticated attacker. (CVSS 8.8)
- [CVE-2018-21201](https://cve.now/CVE-2018-21201.md): Certain NETGEAR devices are affected by a stack-based buffer overflow by an authenticated user. (CVSS 6.8)
- [CVE-2018-21200](https://cve.now/CVE-2018-21200.md): Certain NETGEAR devices are affected by a stack-based buffer overflow by an authenticated user. (CVSS 6.8)
- [CVE-2018-21199](https://cve.now/CVE-2018-21199.md): Certain NETGEAR devices are affected by a stack-based buffer overflow by an authenticated user. (CVSS 6.8)
- [CVE-2018-21198](https://cve.now/CVE-2018-21198.md): Certain NETGEAR devices are affected by a stack-based buffer overflow by an authenticated user. (CVSS 6.8)
- [CVE-2018-21197](https://cve.now/CVE-2018-21197.md): Certain NETGEAR devices are affected by a stack-based buffer overflow by an authenticated user. (CVSS 6.8)
- [CVE-2018-21196](https://cve.now/CVE-2018-21196.md): Certain NETGEAR devices are affected by a stack-based buffer overflow by an authenticated user. (CVSS 6.8)
- [CVE-2018-21195](https://cve.now/CVE-2018-21195.md): Certain NETGEAR devices are affected by a stack-based buffer overflow by an authenticated user. (CVSS 6.8)
- [CVE-2018-21194](https://cve.now/CVE-2018-21194.md): Certain NETGEAR devices are affected by a stack-based buffer overflow by an authenticated user. (CVSS 6.8)
- [CVE-2018-21193](https://cve.now/CVE-2018-21193.md): Certain NETGEAR devices are affected by a stack-based buffer overflow by an authenticated user. (CVSS 6.8)
- [CVE-2018-21192](https://cve.now/CVE-2018-21192.md): Certain NETGEAR devices are affected by a stack-based buffer overflow by an authenticated user. (CVSS 6.8)
- [CVE-2018-21191](https://cve.now/CVE-2018-21191.md): Certain NETGEAR devices are affected by a stack-based buffer overflow by an authenticated user. (CVSS 6.8)
- [CVE-2018-21190](https://cve.now/CVE-2018-21190.md): Certain NETGEAR devices are affected by a stack-based buffer overflow by an authenticated user. (CVSS 6.8)
- [CVE-2018-21189](https://cve.now/CVE-2018-21189.md): Certain NETGEAR devices are affected by a stack-based buffer overflow by an authenticated user. (CVSS 6.8)
- [CVE-2018-21188](https://cve.now/CVE-2018-21188.md): Certain NETGEAR devices are affected by a stack-based buffer overflow by an authenticated user. (CVSS 6.8)
- [CVE-2018-21187](https://cve.now/CVE-2018-21187.md): Certain NETGEAR devices are affected by a stack-based buffer overflow by an authenticated user. (CVSS 6.8)
- [CVE-2018-21186](https://cve.now/CVE-2018-21186.md): Certain NETGEAR devices are affected by a stack-based buffer overflow by an authenticated user. (CVSS 6.8)
- [CVE-2020-1774](https://cve.now/CVE-2020-1774.md): Information disclosure (CVSS 4.5, OTRS AG ((OTRS)) Community Edition · OTRS AG OTRS)
- [CVE-2020-4329](https://cve.now/CVE-2020-4329.md): IBM WebSphere Application Server 7.0, 8.0, 8.5, 9.0 and Liberty 17.0.0.3 through 20.0.0.4 could allow a remote, authenticated attacker to ob (CVSS 4.3, IBM WebSphere Application Server Liberty · IBM WebSphere Ap…)
- [CVE-2020-10944](https://cve.now/CVE-2020-10944.md): HashiCorp Nomad and Nomad Enterprise up to 0.10.4 contained a cross-site scripting vulnerability such that files from a malicious workload c (no CVSS)
- [CVE-2020-12078](https://cve.now/CVE-2020-12078.md): An issue was discovered in Open-AudIT 3.3.1. (no CVSS)
- [CVE-2020-10093](https://cve.now/CVE-2020-10093.md): A cross-site scripting (XSS) vulnerability in Lexmark Pro910 series inkjet and other discontinued products. (no CVSS)
- [CVE-2020-10094](https://cve.now/CVE-2020-10094.md): A cross-site scripting (XSS) vulnerability in Lexmark CS31x before LW74.VYL.P273; CS41x before LW74.VY2.P273; CS51x before LW74.VY4.P273; CX (no CVSS)
- [CVE-2018-21185](https://cve.now/CVE-2018-21185.md): Certain NETGEAR devices are affected by a stack-based buffer overflow by an authenticated user. (CVSS 6.8)
- [CVE-2018-21184](https://cve.now/CVE-2018-21184.md): Certain NETGEAR devices are affected by a stack-based buffer overflow by an authenticated user. (CVSS 6.8)
- [CVE-2018-21183](https://cve.now/CVE-2018-21183.md): Certain NETGEAR devices are affected by a stack-based buffer overflow by an authenticated user. (CVSS 6.8)
- [CVE-2018-21182](https://cve.now/CVE-2018-21182.md): Certain NETGEAR devices are affected by a stack-based buffer overflow by an authenticated user. (CVSS 6.8)
- [CVE-2018-21181](https://cve.now/CVE-2018-21181.md): Certain NETGEAR devices are affected by a stack-based buffer overflow by an authenticated user. (CVSS 6.8)
- [CVE-2020-12286](https://cve.now/CVE-2020-12286.md): In Octopus Deploy before 2019.12.9 and 2020 before 2020.1.12, the TaskView permission is not scoped to any dimension. (no CVSS)
- [CVE-2020-5570](https://cve.now/CVE-2020-5570.md): Cross-site scripting vulnerability in Sales Force Assistant version 11.2.48 and earlier allows remote authenticated attackers to inject arbi (no CVSS, NI Consulting CO. Sales Force Assistant)
- [CVE-2020-12284](https://cve.now/CVE-2020-12284.md): cbs\_jpeg\_split\_fragment in libavcodec/cbs\_jpeg.c in FFmpeg 4.1 and 4.2.2 has a heap-based buffer overflow during JPEG\_MARKER\_SOS handling be (no CVSS)
- [CVE-2020-5568](https://cve.now/CVE-2020-5568.md): Cross-site scripting vulnerability in Cybozu Garoon 4.6.0 to 5.0.0 allows remote attackers to inject arbitrary web script or HTML via the ap (no CVSS, Cybozu Garoon)
- [CVE-2020-5566](https://cve.now/CVE-2020-5566.md): Improper authorization vulnerability in Cybozu Garoon 4.0.0 to 4.10.3 allows remote authenticated attackers to alter the application's data (no CVSS, Cybozu Garoon)
- [CVE-2020-5567](https://cve.now/CVE-2020-5567.md): Improper authentication vulnerability in Cybozu Garoon 4.0.0 to 4.10.3 allows remote attackers to obtain data in Application Menu. (no CVSS, Cybozu Garoon)
- [CVE-2020-5564](https://cve.now/CVE-2020-5564.md): Cross-site scripting vulnerability in Cybozu Garoon 4.0.0 to 4.10.3 allows remote attackers to inject arbitrary web script or HTML via the a (no CVSS, Cybozu Garoon)
- [CVE-2020-5565](https://cve.now/CVE-2020-5565.md): Improper input validation vulnerability in Cybozu Garoon 4.0.0 to 4.10.3 allows a remote authenticated attacker to alter the application's d (no CVSS, Cybozu Garoon)
- [CVE-2020-5562](https://cve.now/CVE-2020-5562.md): Server-side request forgery (SSRF) vulnerability in Cybozu Garoon 4.6.0 to 4.6.3 allows a remote attacker with an administrative privilege t (no CVSS, Cybozu Garoon)
- [CVE-2020-5563](https://cve.now/CVE-2020-5563.md): Improper authentication vulnerability in Cybozu Garoon 4.0.0 to 4.10.3 allows remote attackers to obtain data in the affected product via th (no CVSS, Cybozu Garoon)
- [CVE-2020-12430](https://cve.now/CVE-2020-12430.md): An issue was discovered in qemuDomainGetStatsIOThread in qemu/qemu\_driver.c in libvirt 4.10.0 though 6.x before 6.1.0. (no CVSS)
- [CVE-2020-1745](https://cve.now/CVE-2020-1745.md): A file inclusion vulnerability was found in the AJP connector enabled with a default AJP configuration port of 8009 in Undertow version 2.0. (CVSS 8.6, undertow-io undertow · io.undertow:undertow-core)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2020-04-28
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.