CVEs published in April 2020
2,302 vulnerabilities, 307 critical, 16 exploited.
- netgear d7800 firmware, dm200 firmware, r6100 firmware +8 more +10 moreCertain NETGEAR devices are affected by a stack-based buffer overflow by an authenticated user....6.8 Medium
- netgear r7800 firmwareNETGEAR R7800 devices before 1.0.2.60 are affected by command injection by an authenticated user.7.6 High
- netgear r7800 firmwareNETGEAR R7800 devices before 1.0.2.60 are affected by command injection by an authenticated user.7.6 High
- netgear r7800 firmwareNETGEAR R7800 devices before 1.0.2.60 are affected by command injection by an authenticated user.6.8 Medium
- opmantek open-auditAn issue was discovered in Open-AudIT 3.2.2. There is OS Command injection in Discovery.8.8 High
- fortinet fortimail, fortivoice, fortivoiceenterprise +2 moreAn improper authentication vulnerability in FortiMail 5.4.10, 6.0.7, 6.2.2 and earlier and...9.8 Critical
- apache iotdbImproper Certificate Validation in Apache IoTDB9.8 Critical
- ushareit shareitSHAREit through 4.0.6.177 does not check the full message length from the received packet header ...7.5 High
- ushareit shareitSHAREit through 4.0.6.177 does not check the body length from the received packet header (which...7.5 High
- netgear wac120 firmware, wac505 firmware, wac510 firmware +8 more +10 moreCertain NETGEAR devices are affected by a stack-based buffer overflow by an unauthenticated...7.1 High
- netgear wac120 firmware, wac505 firmware, wac510 firmware +8 more +10 moreCertain NETGEAR devices are affected by CSRF. This affects WAC120 before 2.1.7, WAC505 before 5.0...5.2 Medium
- netgear srr60 firmware, srs60 firmware +1 moreCertain NETGEAR devices are affected by stored XSS. This affects SRR60 before 2.2.1.210 and SRS60...4.3 Medium
- apache log4j, debian linux, oracle communications application session controller +43 more +45 moreImproper validation of certificate with host mismatch in Apache Log4j SMTP appender3.7 Low
- huawei ar3200, ar3200 firmware +1 moreHuawei AR3200 products with versions of V200R007C00SPC900, V200R007C00SPCa00, V200R007C00SPCb00,...9.8 Critical
- huawei lion-al00c, lion-al00c firmware +1 moreHuawei smartphone Lion-AL00C with versions earlier than 10.0.0.205(C00E202R7P2) have a denial of...5.5 Medium
- valvesoftware sourceValve Source allows local users to gain privileges by writing to the /tmp/hl2_relaunch file,...7.8 High
- huawei honor v10, honor v10 firmware +1 moreHuawei Honor V10 smartphones with versions earlier than 10.0.0.156(C00E156R2P4) has three out of...7.1 High
- huawei honor v10, honor v10 firmware +1 moreHuawei Honor V10 smartphones with versions earlier than 10.0.0.156(C00E156R2P4) has three out of...7.1 High
- huawei honor v10, honor v10 firmware +1 moreHuawei Honor V10 smartphones with versions earlier than 10.0.0.156(C00E156R2P4) has three out of...7.1 High
- openvpn, debian linux, fedoraproject fedora +2 moreAn issue was discovered in OpenVPN 2.4.x before 2.4.9. An attacker can inject a data channel v2 ...3.7 Low
- netgear wac120 firmware, wac505 firmware, wac510 firmware +8 more +10 moreCertain NETGEAR devices are affected by incorrect configuration of security settings. This...7.3 High
- netgear d8500 firmware, ex3700 firmware, ex3800 firmware +27 more +29 moreCertain NETGEAR devices are affected by a stack-based buffer overflow by an unauthenticated...6.4 Medium
- sonatype nexus repository managerAn issue was discovered in Sonatype Nexus Repository Manager 2.x before 2.14.17 and 3.x before 3...4.9 Medium
- huawei osd, osd firmware +1 moreHuawei OSD product with versions earlier than OSD_uwp_9.0.32.0 have a local privilege escalation...6.7 Medium
- wavlink jetstream ac3000 firmware, jetstream erac3000 firmware, wl-wn530hg4 firmware +12 more +14 moreAn issue was discovered on WAVLINK WL-WN579G3 M79X3.V5030.180719, WL-WN575A3 RPT75A3.V4300.180801...7.5 High
- amd atillk64AMD ATI atillk64.sys 5.11.9.0 allows low-privileged users to interact directly with physical...8.8 High
- huawei mate 20, mate 20 firmware +1 moreHUAWEI Mate 20 smartphones with versions earlier than 10.0.0.188(C00E74R3P8) have an improper...3.5 Low
- solarwinds webhelpdeskFormula Injection exists in the export feature in SolarWinds WebHelpDesk 12.7.1 via a value ...7.8 High
- honor pcmanagerHuawei PCManager product with versions earlier than 10.0.5.53 have a local privilege escalation...6.7 Medium
- farukawa electric consciousmapThe Apros Evolution, ConsciusMap, and Furukawa provisioning systems through 2.8.1 allow remote...9.8 Critical
- rukovoditelIn Rukovoditel 2.5.2, there is a stored XSS vulnerability on the application structure --> user...6.1 Medium
- prestashop correos expressThe Correos Express addon for PrestaShop 1.6 through 1.7 allows remote attackers to obtain...7.5 High
- rukovoditelIn Rukovoditel 2.5.2, users' passwords and usernames are stored in a cookie with URL encoding,...5.3 Medium
- hp service pack for proliant, hpe business critical hard drives, nvme mixed use solid state drives +5 more +7 moreA potential security vulnerability has been identified in the disk drive firmware installers...7.8 High
- rukovoditelIn Rukovoditel V2.5.2, attackers can upload an arbitrary file to the server just changing the the...9.8 Critical
- wisc htcondor, debian linux, fedoraproject fedora +2 moreHTCondor up to and including stable series 8.8.6 and development series 8.9.4 has Incorrect...9.8 Critical
- pypolicyd-spf project pypolicyd-spf, trusteddomain opendmarc, fedoraproject fedora +2 moreOpenDMARC through 1.3.2 and 1.4.x, when used with pypolicyd-spf 2.0.2, allows attacks that bypass...9.8 Critical
- apache tika, the apache software foundation apache tika, oracle communications messaging server +3 more +5 moreMissing Release of Memory after Effective Lifetime in Apache Tika5.5 Medium
- ibm cognos analytics, netapp oncommand insight +1 moreIBM Cognos Analytics 11.0 and 11.1 could allow a remote attacker to obtain sensitive information...4.3 Medium
- abb cs141 firmwareUPS Adapter CS141 before 1.90 allows Directory Traversal. An attacker with Admin or Engineer...6.5 Medium
- eleveo call recordingZOOM International Call Recording 6.3.1 suffers from multiple authenticated stored XSS...5.4 Medium
- percona xtradb clusterAn issue was discovered in Percona XtraDB Cluster before 5.7.28-31.42. A bundled script...8.1 High
- percona xtrabackupPercona XtraBackup before 2.4.20 unintentionally writes the command line to any resulting backup...6.5 Medium
- testlinkIn TestLink 1.9.20, a crafted login.php viewer parameter exposes cleartext credentials.7.5 High
- testlinkIn TestLink 1.9.20, the lib/cfields/cfieldsExport.php goback_url parameter causes a security risk...9.8 Critical
- grafanaGrafana version < 6.7.3 is vulnerable for annotation popup XSS.6.1 Medium
- windriver vxworksThe IGMP component in VxWorks 6.8.3 IPNET CVE patches created in 2019 has a NULL Pointer...7.5 High
- sophos sfosA SQL injection issue was found in SFOS 17.0, 17.1, 17.5, and 18.0 before 2020-04-25 on Sophos XG...10.0 Critical
- bluezoneReact Native Bluetooth Scan in Bluezone 1.0.0 uses six-character alphanumeric IDs, which might...6.5 Medium
- artifex jbig2dec, debian linux, opensuse leap +2 morejbig2_image_compose in jbig2_image.c in Artifex jbig2dec before 0.18 has a heap-based buffer...9.8 Critical
- Show moreLoading…