CVEs published in April 2020
2,302 vulnerabilities, 307 critical, 16 exploited.
- 3xlogic infinias eidc32 firmware, infinias eidc32 web +1 more3xLOGIC Infinias eIDC32 2.213 devices with Web 1.107 allow Authentication Bypass via CMD.HTM?CMD=...9.8 Critical
- ivanti workspace controlIvanti Workspace Control before 10.4.30.0, when SCCM integration is enabled, allows local users...5.5 Medium
- getgrav gravOpen Redirect in Grav6.1 Medium
- bit2spr project bit2sprbit2spr 1992-06-07 has a stack-based buffer overflow (129-byte write) in conv_bitmap in bit2spr.c...7.5 High
- zohocorp manageengine opmanagerIn Zoho ManageEngine OpManager before 12.4.181, an unauthenticated remote attacker can send a...7.5 High
- zohocorp manageengine adselfservice plusZoho ManageEngine ADSelfService Plus before 5815 allows unauthenticated remote code execution.9.8 Critical
- dell cpg bios, latitude 7202 firmware +1 moreDell Latitude 7202 Rugged Tablet BIOS versions prior to A28 contain a UAF vulnerability in...6.8 Medium
- dell emc isilon onefs, isilon onefs +1 moreDell EMC Isilon OneFS versions 8.2.2 and earlier contain a denial of service vulnerability....5.3 Medium
- isaacs node-tarnode-tar: Uncaught Exception DoS via NUL byte in PAX path/linkpath records5.3 Medium
- isaacs node-tar, tar +1 morenode-tar applies PAX size override to intermediary GNU long-name/long-link headers, causing tar parser interpretation differential (file smuggling)6.9 Medium
- isaacs node-tar, tar, red hat confidential compute attestation +40 more +42 morenode-tar Vulnerable to Arbitrary File Overwrite and Symlink Poisoning via Insufficient Path Sanitization8.2 High
- highcharts, netapp cloud backup, oncommand insight +2 more +4 moreOptions structure open to XSS if passed unfiltered7.6 High
- revive-adserver revive adserverAn Open Redirect vulnerability was discovered in Revive Adserver version < 5.0.5 and reported by...6.1 Medium
- utils-extend project utils-extendPrototype Pollution9.8 Critical
- revive-adserver revive adserverA security restriction bypass vulnerability has been discovered in Revive Adserver version < 5.0...6.8 Medium
- testlinkAn unrestricted file upload vulnerability in keywordsImport.php in TestLink 1.9.20 allows remote...8.8 High
- testlinkA SQL injection vulnerability in TestLink 1.9.20 allows attackers to execute arbitrary SQL...9.8 Critical
- testlinkA SQL injection vulnerability in TestLink 1.9.20 allows attackers to execute arbitrary SQL...9.8 Critical
- belden hirschmann hios, hirschmann hisecos, hirschmann automation and control gmbh, a division of belden inc. hios for the following devices rsp, rspe, rsps, rspl, msp, ees, ees, eesx, grs, os, red +1 more +3 moreA buffer overflow vulnerability was found in some devices of Hirschmann Automation and Control...9.8 Critical
- visam vbase editor, vbase web-remote module, vbase web-remote +2 moreVISAM VBASE Editor version 11.5.0.2 and VBASE Web-Remote Module may allow a vulnerable ActiveX...9.8 Critical
- visam vbase editor, vbase web-remote module, vbase web-remote +2 moreVISAM VBASE Editor version 11.5.0.2 and VBASE Web-Remote Module may allow an unauthenticated...7.5 High
- visam vbase editor, vbase web-remote module, vbase web-remote +2 moreVISAM VBASE Editor version 11.5.0.2 and VBASE Web-Remote Module allow weak hashing algorithm and...7.8 High
- visam vbase editor, vbase web-remote module, vbase web-remote +2 moreVISAM VBASE Editor version 11.5.0.2 and VBASE Web-Remote Module may allow weak or insecure...8.8 High
- visam vbase editor, vbase web-remote module, vbase web-remote +2 moreVISAM VBASE Editor version 11.5.0.2 and VBASE Web-Remote Module may allow input passed in the URL...7.5 High
- joobyHTTP Response Splitting6.5 Medium
- eclipse che, red hat eclipse che +1 moreMissing Authorization in Eclipse Che6.4 Medium
- mageewp onetoneincludes/theme-functions.php in the OneTone theme through 3.0.6 for WordPress allows...5.3 Medium
- mageewp onetoneincludes/theme-functions.php in the OneTone theme through 3.0.6 for WordPress has multiple stored...6.1 Medium
- gnu gnutls, canonical ubuntu linux, debian linux +5 more +7 moreGnuTLS 3.6.x before 3.6.13 uses incorrect cryptography for DTLS. The earliest affected version is...7.4 High
- ibm spectrum scaleIBM Spectrum Scale 4.2 and 5.0 could allow a local unprivileged attacker with intimate knowledge...7.4 High
- zoom meetingsZoom Client for Meetings through 4.6.9 uses the ECB mode of AES for video and audio encryption....7.5 High
- opensuse autoyast2, suse linux enterprise server 12, linux enterprise server 15 +2 moreDeprecated functionality in autoyast2 automatically imports gpg keys without checking them4.8 Medium
- viewvcXSS vulnerability in CVS show_subdir_lastmod support3.1 Low
- mozilla firefox, firefox esr, thunderbird +1 more +3 moreUnder certain conditions, when handling a ReadableStream, a race condition can cause a use-after...8.1 High
- mozilla firefox, firefox esr, thunderbird +1 more +3 moreUnder certain conditions, when running the nsDocShell destructor, a race condition can cause a...8.1 High
varnishMageiaUpdated varnish packages fix security vulnerabilityNo score- firmware analysis and comparison tool project analysis and comparison toolFirmware Analysis and Comparison Tool (FACT) 3 has Stored XSS when updating analysis details via...3.3 Low
- slack nebulaSlack Nebula through 1.1.0 contains a relative path vulnerability that allows a low-privileged attacker to execute code in the context of the root user via tun_darwin.go or tun_windows.go. A user can…8.8 High
- git-add-remote project git-add-remoteOS Command Injection in git-add-remote9.8 Critical
- install-package project install-packageOS Command Injection in install-package9.8 Critical
- umount project umount, install-package project install-package +1 moreCommand Injection in umount9.8 Critical
- starface unified communication \& collaboration clientSTARFACE UCC Client before 6.7.1.204 on WIndows allows binary planting to execute code with...9.8 Critical
- node-key-sender project node-key-senderOS Command Injection in node-key-sender9.8 Critical
- karma-mojo project karma-mojokarma-mojo enables OS Command Injection9.8 Critical
- op-browser project op-browserInjection in op-browser9.8 Critical
- effect-ts effectWithdrawn Advisory: OS Command Injection in effect9.8 Critical
- jscover project jscoverOS Command Injection in jscover9.8 Critical
- ibm strongloop nginx controllerOS Command Injection in strong-nginx-controller9.8 Critical
- get-git-data project get-git-dataCommand injection in get-git-data9.8 Critical
- netease pomelo-monitorOS Command Injection in pomelo-monitor9.8 Critical
- Show moreLoading…