# CVEs published 2020-04-30

55 CVEs were published on April 30, 2020: 2 critical, 2 high. 2 are now in CISA KEV. Days are UTC.

- [CVE-2020-11016](https://cve.now/CVE-2020-11016.md): Remote code execution in Message sending functionality in IntelMQ Manager (CVSS 9.1, certtools IntelMQ Manager)
- [CVE-2020-11037](https://cve.now/CVE-2020-11037.md): Potential Observable Timing Discrepancy in Wagtail (CVSS 6.1, Wagtail)
- [CVE-2020-11026](https://cve.now/CVE-2020-11026.md): Specially crafted filenames in WordPress leading to XSS (CVSS 8.7, WordPress)
- [CVE-2020-11028](https://cve.now/CVE-2020-11028.md): Unauthenticated disclosure of certain private posts in WordPress (CVSS 5.8, WordPress)
- [CVE-2020-11029](https://cve.now/CVE-2020-11029.md): Cross-site scripting in stats method (object cache) in WordPress (CVSS 5.8, WordPress)
- [CVE-2020-11030](https://cve.now/CVE-2020-11030.md): Cross-site scripting (XSS) in Search block in WordPress (CVSS 6.4, WordPress)
- [CVE-2020-11025](https://cve.now/CVE-2020-11025.md): Authenticated cross-site scripting (XSS) in WordPress Customizer (CVSS 5.8, WordPress)
- [CVE-2020-9098](https://cve.now/CVE-2020-9098.md): Huawei OceanStor 5310 product with version of V500R007C60SPC100 has an invalid pointer access vulnerability. (no CVSS, OceanStor 5310)
- [CVE-2020-1817](https://cve.now/CVE-2020-1817.md): Huawei PCManager with versions earlier than 10.0.1.36 has a privilege escalation vulnerability. (no CVSS, PCManager)
- [CVE-2020-6866](https://cve.now/CVE-2020-6866.md): A ZTE product is impacted by a resource management error vulnerability. (no CVSS, ZXCTN)
- [CVE-2020-6865](https://cve.now/CVE-2020-6865.md): ZTE SDN controller platform is impacted by an information leakage vulnerability. (no CVSS, OSCP)
- [CVE-2020-6867](https://cve.now/CVE-2020-6867.md): ZTE's SDON controller is impacted by the resource management error vulnerability. (no CVSS, ZENIC ONE R22b)
- [CVE-2020-5890](https://cve.now/CVE-2020-5890.md): On BIG-IP 15.0.0-15.0.1, 14.1.0-14.1.2.3, 13.1.0-13.1.3.3, and 12.1.0-12.1.5.1 and BIG-IQ 5.2.0-7.1.0, when creating a QKView, credentials f (no CVSS, BIG-IP · BIG-IQ)
- [CVE-2020-5888](https://cve.now/CVE-2020-5888.md): On versions 15.1.0-15.1.0.1, 15.0.0-15.0.1.2, and 14.1.0-14.1.2.3, BIG-IP Virtual Edition (VE) may expose a mechanism for adjacent network ( (no CVSS, BIG-IP VE)
- [CVE-2020-5892](https://cve.now/CVE-2020-5892.md): In versions 7.1.5-7.1.8, the BIG-IP Edge Client components in BIG-IP APM, Edge Gateway, and FirePass legacy allow attackers to obtain the fu (no CVSS, BIG-IP Edge Client)
- [CVE-2020-5893](https://cve.now/CVE-2020-5893.md): In versions 7.1.5-7.1.8, when a user connects to a VPN using BIG-IP Edge Client over an unsecure network, BIG-IP Edge Client responds to aut (no CVSS, BIG-IP Edge Client)
- [CVE-2020-5889](https://cve.now/CVE-2020-5889.md): On versions 15.1.0-15.1.0.1, 15.0.0-15.0.1.2, and 14.1.0-14.1.2.3, in BIG-IP APM portal access, a specially crafted HTTP request can lead to (no CVSS, BIG-IP APM)
- [CVE-2020-5891](https://cve.now/CVE-2020-5891.md): On BIG-IP 15.1.0-15.1.0.1, 15.0.0-15.0.1.2, and 14.1.0-14.1.2.3, undisclosed HTTP/2 requests can lead to a denial of service when sent to a (no CVSS, BIG-IP)
- [CVE-2020-5880](https://cve.now/CVE-2020-5880.md): Om BIG-IP 15.0.0-15.0.1.3 and 14.1.0-14.1.2.3, the restjavad process may expose a way for attackers to upload arbitrary files on the BIG-IP (no CVSS, BIG-IP)
- [CVE-2020-5886](https://cve.now/CVE-2020-5886.md): On versions 15.0.0-15.1.0.1, 14.1.0-14.1.2.3, 13.1.0-13.1.3.3, and 12.1.0-12.1.5.1, BIG-IP systems setup for connection mirroring in a High (no CVSS, BIG-IP)
- [CVE-2020-5883](https://cve.now/CVE-2020-5883.md): On BIG-IP 15.0.0-15.0.1, 14.1.0-14.1.2.3, 14.0.0-14.0.1, and 13.1.0-13.1.3.1, when a virtual server is configured with HTTP explicit proxy a (no CVSS, BIG-IP)
- [CVE-2020-5879](https://cve.now/CVE-2020-5879.md): On BIG-IP ASM 11.6.1-11.6.5.1, under certain configurations, the BIG-IP system sends data plane traffic to back-end servers unencrypted, eve (no CVSS, BIG-IP ASM)
- [CVE-2020-5887](https://cve.now/CVE-2020-5887.md): On versions 15.1.0-15.1.0.1, 15.0.0-15.0.1.2, and 14.1.0-14.1.2.3, BIG-IP Virtual Edition (VE) may expose a mechanism for remote attackers t (no CVSS, BIG-IP VE)
- [CVE-2020-5885](https://cve.now/CVE-2020-5885.md): On versions 15.0.0-15.1.0.1, 14.1.0-14.1.2.3, 13.1.0-13.1.3.3, and 12.1.0-12.1.5.1, BIG-IP systems set up for connection mirroring in a high (no CVSS, BIG-IP)
- [CVE-2020-5881](https://cve.now/CVE-2020-5881.md): On versions 15.0.0-15.1.0.1, 14.1.0-14.1.2.3, and 13.1.0-13.1.3.3, when the BIG-IP Virtual Edition (VE) is configured with VLAN groups and t (no CVSS, BIG-IP VE)
- [CVE-2020-5882](https://cve.now/CVE-2020-5882.md): On BIG-IP 15.0.0-15.0.1.3, 14.1.0-14.1.2.3, 13.1.0-13.1.3.3, 12.1.0-12.1.5, and 11.6.1-11.6.5.1, under certain conditions, the Intel QuickAs (no CVSS, BIG-IP)
- [CVE-2020-5884](https://cve.now/CVE-2020-5884.md): On versions 15.0.0-15.1.0.3, 14.1.0-14.1.2.4, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1, the default deployment mode for BIG-IP (no CVSS, BIG-IP)
- [CVE-2020-5877](https://cve.now/CVE-2020-5877.md): On BIG-IP 15.0.0-15.1.0.1, 14.1.0-14.1.2.3, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1, malformed input to the DATAGRAM::tcp iRul (no CVSS, BIG-IP)
- [CVE-2020-5876](https://cve.now/CVE-2020-5876.md): On BIG-IP 15.0.0-15.0.1.3, 14.1.0-14.1.2.3, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1, a race condition exists where mcpd and ot (no CVSS, BIG-IP)
- [CVE-2020-5875](https://cve.now/CVE-2020-5875.md): On BIG-IP 15.0.0-15.0.1 and 14.1.0-14.1.2.3, under certain conditions, the Traffic Management Microkernel (TMM) may generate a core file and (no CVSS, BIG-IP)
- [CVE-2020-5878](https://cve.now/CVE-2020-5878.md): On versions 15.1.0-15.1.0.1, 15.0.0-15.0.1.1, and 14.1.0-14.1.2.3, Traffic Management Microkernel (TMM) may restart on BIG-IP Virtual Editio (no CVSS, BIG-IP VE)
- [CVE-2020-5873](https://cve.now/CVE-2020-5873.md): On BIG-IP 15.0.0-15.0.1, 14.1.0-14.1.2.3, 13.1.0-13.1.3.1, 12.1.0-12.1.5, and 11.6.1-11.6.5 and BIG-IQ 5.2.0-7.1.0, a user associated with t (no CVSS, BIG-IP · BIG-IQ)
- [CVE-2020-5874](https://cve.now/CVE-2020-5874.md): On BIG-IP APM 15.0.0-15.0.1.2, 14.1.0-14.1.2.3, and 14.0.0-14.0.1, in certain circumstances, an attacker sending specifically crafted reques (no CVSS, BIG-IP APM)
- [CVE-2020-5872](https://cve.now/CVE-2020-5872.md): On BIG-IP 14.1.0-14.1.2.3, 14.0.0-14.0.1, 13.1.0-13.1.3.1, and 12.1.0-12.1.4.1, when processing TLS traffic with hardware cryptographic acce (no CVSS, BIG-IP)
- [CVE-2020-5871](https://cve.now/CVE-2020-5871.md): On BIG-IP 14.1.0-14.1.2.3, undisclosed requests can lead to a denial of service (DoS) when sent to BIG-IP HTTP/2 virtual servers. (no CVSS, BIG-IP)
- [CVE-2019-0235](https://cve.now/CVE-2019-0235.md): Apache OFBiz 17.12.01 is vulnerable to some CSRF attacks. (no CVSS, Apache OFBiz)
- [CVE-2019-12425](https://cve.now/CVE-2019-12425.md): Apache OFBiz 17.12.01 is vulnerable to Host header injection by accepting arbitrary host (no CVSS, Apache OFBiz)
- [CVE-2020-7136](https://cve.now/CVE-2020-7136.md): A security vulnerability in HPE Smart Update Manager (SUM) prior to version 8.5.6 could allow remote unauthorized access. (no CVSS, Hewlett Packard Enterprise Smart Update Manager)
- [CVE-2020-11652](https://cve.now/CVE-2020-11652.md): An issue was discovered in SaltStack Salt before 2019.2.4 and 3000 before 3000.2. (CVSS 6.5, KEV, salt)
- [CVE-2020-11651](https://cve.now/CVE-2020-11651.md): An issue was discovered in SaltStack Salt before 2019.2.4 and 3000 before 3000.2. (CVSS 9.8, KEV, salt)
- [CVE-2020-10691](https://cve.now/CVE-2020-10691.md): An archive traversal flaw was found in all ansible-engine versions 2.9.x prior to 2.9.7, when running ansible-galaxy collection install. (CVSS 5.2, Red Hat Ansible · ansible)
- [CVE-2020-12050](https://cve.now/CVE-2020-12050.md): SQLiteODBC 0.9996, as packaged for certain Linux distributions as 0.9996-4, has a race condition leading to root privilege escalation becaus (no CVSS)
- [CVE-2020-6010](https://cve.now/CVE-2020-6010.md): LearnPress Wordpress plugin version prior and including 3.2.6.7 is vulnerable to SQL Injection (no CVSS, LearnPress Wordpress Plugin)
- [CVE-2020-12101](https://cve.now/CVE-2020-12101.md): The address-management feature in xt:Commerce 5.1 to 6.2.2 allows remote authenticated users to zero out other user's stored addresses by ma (no CVSS)
- [CVE-2019-19215](https://cve.now/CVE-2019-19215.md): A buffer overflow vulnerability in BMC Control-M/Agent 7.0.00.000 when the On-Do action destination is Mail and the Control-M/Agent is confi (no CVSS)
- [CVE-2019-19216](https://cve.now/CVE-2019-19216.md): BMC Control-M/Agent 7.0.00.000 has an Insecure File Copy. (no CVSS)
- [CVE-2019-19217](https://cve.now/CVE-2019-19217.md): BMC Control-M/Agent 7.0.00.000 allows OS Command Injection. (no CVSS)
- [CVE-2019-19218](https://cve.now/CVE-2019-19218.md): BMC Control-M/Agent 7.0.00.000 has Insecure Password Storage. (no CVSS)
- [CVE-2019-19219](https://cve.now/CVE-2019-19219.md): BMC Control-M/Agent 7.0.00.000 allows Arbitrary File Download. (no CVSS)
- [CVE-2019-19220](https://cve.now/CVE-2019-19220.md): BMC Control-M/Agent 7.0.00.000 allows OS Command Injection (issue 2 of 2). (no CVSS)
- [CVE-2020-6579](https://cve.now/CVE-2020-6579.md): Cross-site scripting (XSS) vulnerability in mailhive/cloudbeez/cloudloader.php and mailhive/cloudbeez/cloudloader\_core.php in the MailBeez p (no CVSS)
- [CVE-2020-9387](https://cve.now/CVE-2020-9387.md): In Mahara 19.04 before 19.04.5 and 19.10 before 19.10.3, account details are shared in the Elasticsearch results for accounts that are not a (no CVSS)
- [CVE-2020-12283](https://cve.now/CVE-2020-12283.md): Sourcegraph before 3.15.1 has a vulnerable authentication workflow because of improper validation in the SafeRedirectURL method in cmd/front (no CVSS, github.com/sourcegraph/sourcegraph)
- [CVE-2020-11027](https://cve.now/CVE-2020-11027.md): Password reset links invalidation issue in WordPress (CVSS 6.1, WordPress)
- [CVE-2020-1752](https://cve.now/CVE-2020-1752.md): A use-after-free vulnerability introduced in glibc upstream version 2.14 was found in the way the tilde expansion was carried out. (CVSS 7.0, GNU Libc glibc)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2020-04-30
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.