CVEs published April 30, 2020
55 CVEs were published on April 30, 2020: 2 critical, 2 high. 2 are now in CISA KEV.
- Published
- 55
- Critical
- 2
- High
- 2
- Medium
- 8
- Low
- 0
- Unrated
- 43
- Now in CISA KEV
- 2
- Fix available
- 12
Most affected products
- BIG-IP
- 12
- WordPress
- 6
- BIG-IP VE
- 4
- Apache OFBiz
- 2
- BIG-IP · BIG-IQ
- 2
- BIG-IP APM
- 2
- BIG-IP Edge Client
- 2
- salt
- 2
- BIG-IP ASM
- 1
- certtools IntelMQ Manager
- 1
Critical 2
High 2
Medium, low and unrated 51
- CVE-2020-11037Potential Observable Timing Discrepancy in WagtailWagtail
- CVE-2020-11028Unauthenticated disclosure of certain private posts in WordPressWordPress
- CVE-2020-11029Cross-site scripting in stats method (object cache) in WordPressWordPress
- CVE-2020-11030Cross-site scripting (XSS) in Search block in WordPressWordPress
- CVE-2020-11025Authenticated cross-site scripting (XSS) in WordPress CustomizerWordPress
- CVE-2020-9098Huawei OceanStor 5310 product with version of V500R007C60SPC100 has an invalid pointer access vulnerability.OceanStor 5310
- CVE-2020-1817Huawei PCManager with versions earlier than 10.0.1.36 has a privilege escalation vulnerability.PCManager
- CVE-2020-6866A ZTE product is impacted by a resource management error vulnerability.ZXCTN
- CVE-2020-6865ZTE SDN controller platform is impacted by an information leakage vulnerability.OSCP
- CVE-2020-6867ZTE's SDON controller is impacted by the resource management error vulnerability.ZENIC ONE R22b
- CVE-2020-5890On BIG-IP 15.0.0-15.0.1, 14.1.0-14.1.2.3, 13.1.0-13.1.3.3, and 12.1.0-12.1.5.1 and BIG-IQ 5.2.0-7.1.0, when creating a QKView, credentials fBIG-IP · BIG-IQ
- CVE-2020-5888On versions 15.1.0-15.1.0.1, 15.0.0-15.0.1.2, and 14.1.0-14.1.2.3, BIG-IP Virtual Edition (VE) may expose a mechanism for adjacent network (BIG-IP VE
- CVE-2020-5892In versions 7.1.5-7.1.8, the BIG-IP Edge Client components in BIG-IP APM, Edge Gateway, and FirePass legacy allow attackers to obtain the fuBIG-IP Edge Client
- CVE-2020-5893In versions 7.1.5-7.1.8, when a user connects to a VPN using BIG-IP Edge Client over an unsecure network, BIG-IP Edge Client responds to autBIG-IP Edge Client
- CVE-2020-5889On versions 15.1.0-15.1.0.1, 15.0.0-15.0.1.2, and 14.1.0-14.1.2.3, in BIG-IP APM portal access, a specially crafted HTTP request can lead toBIG-IP APM
- CVE-2020-5891On BIG-IP 15.1.0-15.1.0.1, 15.0.0-15.0.1.2, and 14.1.0-14.1.2.3, undisclosed HTTP/2 requests can lead to a denial of service when sent to a BIG-IP
- CVE-2020-5880Om BIG-IP 15.0.0-15.0.1.3 and 14.1.0-14.1.2.3, the restjavad process may expose a way for attackers to upload arbitrary files on the BIG-IP BIG-IP
- CVE-2020-5886On versions 15.0.0-15.1.0.1, 14.1.0-14.1.2.3, 13.1.0-13.1.3.3, and 12.1.0-12.1.5.1, BIG-IP systems setup for connection mirroring in a High BIG-IP
- CVE-2020-5883On BIG-IP 15.0.0-15.0.1, 14.1.0-14.1.2.3, 14.0.0-14.0.1, and 13.1.0-13.1.3.1, when a virtual server is configured with HTTP explicit proxy aBIG-IP
- CVE-2020-5879On BIG-IP ASM 11.6.1-11.6.5.1, under certain configurations, the BIG-IP system sends data plane traffic to back-end servers unencrypted, eveBIG-IP ASM
- CVE-2020-5887On versions 15.1.0-15.1.0.1, 15.0.0-15.0.1.2, and 14.1.0-14.1.2.3, BIG-IP Virtual Edition (VE) may expose a mechanism for remote attackers tBIG-IP VE
- CVE-2020-5885On versions 15.0.0-15.1.0.1, 14.1.0-14.1.2.3, 13.1.0-13.1.3.3, and 12.1.0-12.1.5.1, BIG-IP systems set up for connection mirroring in a highBIG-IP
- CVE-2020-5881On versions 15.0.0-15.1.0.1, 14.1.0-14.1.2.3, and 13.1.0-13.1.3.3, when the BIG-IP Virtual Edition (VE) is configured with VLAN groups and tBIG-IP VE
- CVE-2020-5882On BIG-IP 15.0.0-15.0.1.3, 14.1.0-14.1.2.3, 13.1.0-13.1.3.3, 12.1.0-12.1.5, and 11.6.1-11.6.5.1, under certain conditions, the Intel QuickAsBIG-IP
- CVE-2020-5884On versions 15.0.0-15.1.0.3, 14.1.0-14.1.2.4, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1, the default deployment mode for BIG-IP BIG-IP
- CVE-2020-5877On BIG-IP 15.0.0-15.1.0.1, 14.1.0-14.1.2.3, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1, malformed input to the DATAGRAM::tcp iRulBIG-IP
- CVE-2020-5876On BIG-IP 15.0.0-15.0.1.3, 14.1.0-14.1.2.3, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1, a race condition exists where mcpd and otBIG-IP
- CVE-2020-5875On BIG-IP 15.0.0-15.0.1 and 14.1.0-14.1.2.3, under certain conditions, the Traffic Management Microkernel (TMM) may generate a core file andBIG-IP
- CVE-2020-5878On versions 15.1.0-15.1.0.1, 15.0.0-15.0.1.1, and 14.1.0-14.1.2.3, Traffic Management Microkernel (TMM) may restart on BIG-IP Virtual EditioBIG-IP VE
- CVE-2020-5873On BIG-IP 15.0.0-15.0.1, 14.1.0-14.1.2.3, 13.1.0-13.1.3.1, 12.1.0-12.1.5, and 11.6.1-11.6.5 and BIG-IQ 5.2.0-7.1.0, a user associated with tBIG-IP · BIG-IQ
- CVE-2020-5874On BIG-IP APM 15.0.0-15.0.1.2, 14.1.0-14.1.2.3, and 14.0.0-14.0.1, in certain circumstances, an attacker sending specifically crafted requesBIG-IP APM
- CVE-2020-5872On BIG-IP 14.1.0-14.1.2.3, 14.0.0-14.0.1, 13.1.0-13.1.3.1, and 12.1.0-12.1.4.1, when processing TLS traffic with hardware cryptographic acceBIG-IP
- CVE-2020-5871On BIG-IP 14.1.0-14.1.2.3, undisclosed requests can lead to a denial of service (DoS) when sent to BIG-IP HTTP/2 virtual servers.BIG-IP
- CVE-2019-0235Apache OFBiz 17.12.01 is vulnerable to some CSRF attacks.Apache OFBiz
- CVE-2019-12425Apache OFBiz 17.12.01 is vulnerable to Host header injection by accepting arbitrary hostApache OFBiz
- CVE-2020-7136A security vulnerability in HPE Smart Update Manager (SUM) prior to version 8.5.6 could allow remote unauthorized access.Hewlett Packard Enterprise Smart Update Manager
- CVE-2020-11652An issue was discovered in SaltStack Salt before 2019.2.4 and 3000 before 3000.2.salt
- CVE-2020-10691An archive traversal flaw was found in all ansible-engine versions 2.9.x prior to 2.9.7, when running ansible-galaxy collection install.Red Hat Ansible · ansible
- CVE-2020-12050SQLiteODBC 0.9996, as packaged for certain Linux distributions as 0.9996-4, has a race condition leading to root privilege escalation becaus
- CVE-2020-6010LearnPress Wordpress plugin version prior and including 3.2.6.7 is vulnerable to SQL InjectionLearnPress Wordpress Plugin
- CVE-2020-12101The address-management feature in xt:Commerce 5.1 to 6.2.2 allows remote authenticated users to zero out other user's stored addresses by ma
- CVE-2019-19215A buffer overflow vulnerability in BMC Control-M/Agent 7.0.00.000 when the On-Do action destination is Mail and the Control-M/Agent is confi
- CVE-2019-19216BMC Control-M/Agent 7.0.00.000 has an Insecure File Copy.
- CVE-2019-19217BMC Control-M/Agent 7.0.00.000 allows OS Command Injection.
- CVE-2019-19218BMC Control-M/Agent 7.0.00.000 has Insecure Password Storage.
- CVE-2019-19219BMC Control-M/Agent 7.0.00.000 allows Arbitrary File Download.
- CVE-2019-19220BMC Control-M/Agent 7.0.00.000 allows OS Command Injection (issue 2 of 2).
- CVE-2020-6579Cross-site scripting (XSS) vulnerability in mailhive/cloudbeez/cloudloader.php and mailhive/cloudbeez/cloudloader_core.php in the MailBeez p
- CVE-2020-9387In Mahara 19.04 before 19.04.5 and 19.10 before 19.10.3, account details are shared in the Elasticsearch results for accounts that are not a
- CVE-2020-12283Sourcegraph before 3.15.1 has a vulnerable authentication workflow because of improper validation in the SafeRedirectURL method in cmd/frontgithub.com/sourcegraph/sourcegraph
- CVE-2020-11027Password reset links invalidation issue in WordPressWordPress