CVEs published in April 2020
2,302 vulnerabilities, 307 critical, 16 exploited.
- maharaIn Mahara 19.04 before 19.04.5 and 19.10 before 19.10.3, account details are shared in the...4.3 Medium
- sourcegraphOpen redirect vulnerability in Sourcegraph6.1 Medium
- wordpress, debian linux +1 morePassword reset links invalidation issue in WordPress6.1 Medium
- videolan vlc media playerAn off-by-one error in the DecodeBlock function in codec/sdl_image.c in VideoLAN VLC media player...7.8 High
- accellion file transfer applianceAccellion File Transfer Appliance Improper Neutralization of Special Elements used in a Command ('Command Injection')9.8 Critical
- accellion file transfer applianceAccellion File Transfer Appliance Use of Hard-coded Credentials9.8 Critical
- abbs software audio media player, abbs software audio media player project software audio media player +1 moreABBS Software Audio Media Player Stack-based Buffer Overflow7.8 High
- abb microscada pro sys600ABB MicroSCADA Pro SYS600 Missing Authentication for Critical Function9.8 Critical
- aasyncAASync.com AASync Stack-based Buffer Overflow9.8 Critical
- a-pdf wav to mp3A-PDF WAV to MP3 Stack-based Buffer Overflow7.8 High
- teampassIncorrect Authorization in TeamPass7.5 High
- teampassTeamPass files are available without authentication7.5 High
- teampassTeamPass PHP arbitrary file include vulnerability8.8 High
- xerox workcentre 3655 firmware, workcentre 3655i firmware, workcentre 5865 firmware +22 more +24 moreXerox WorkCentre 3655, 3655i, 58XX, 58XXi, 59XX, 59XXi, 6655, 6655i, 72XX, 72XXi, 78XX, 78XXi,...9.8 Critical
- opmantek open-auditAn issue was discovered in Open-AudIT 3.2.2. There is Arbitrary file upload.8.8 High
- opmantek open-auditAn issue was discovered in Open-AudIT 3.2.2. There are Multiple SQL Injections.9.8 Critical
- moonlight-stream moonlightMan-in-the-middle attack in Moonlight iOS/tvOS6.1 Medium
- saltstack salt, blackberry workspaces server, canonical ubuntu linux +3 more +5 moreSaltStack Salt is vulnerable Arbitrary Directory Access6.5 Medium
- saltstack salt, canonical ubuntu linux, debian linux +2 more +4 moreSaltStack Salt Unauthenticated Remote Code Execution9.8 Critical
- cisco ios xe sd-wan software, ios xe +1 moreCisco IOS XE SD-WAN Software Command Injection Vulnerability7.8 High
- intelliants subrionSession Fixation in Subrion CMS6.5 Medium
- intelliants subrionSubrion CMS CSV injection via Export Language7.8 High
- intelliants subrionSubrion CMS PHP Object Injection6.5 Medium
- mono monoxMonoX through 5.1.40.5152 allows administrators to execute arbitrary code by modifying an ASPX...7.2 High
- mono monoxMonoX through 5.1.40.5152 allows remote code execution via HTML5Upload.ashx or Pages...9.8 Critical
- mono monoxMonoX through 5.1.40.5152 allows stored XSS via User Status, Blog Comments, or Blog Description.5.4 Medium
- mono monoxMonoX through 5.1.40.5152 allows admins to execute arbitrary programs by reconfiguring the...7.2 High
- linux kernel, netapp active iq unified manager, aff baseboard management controller +6 more +8 moreAn array overflow was discovered in mt76_add_fragment in drivers/net/wireless/mediatek/mt76/dma.c...6.7 Medium
- linux kernel, netapp active iq unified manager, aff a700s +7 more +9 moreusb_sg_cancel in drivers/usb/core/message.c in the Linux kernel before 5.6.8 has a use-after-free...6.7 Medium
- actions http-clientHTTP request which redirect to another hostname do not strip authorization header in Actions Http-Client6.3 Medium
- fayeAuthentication and extension bypass in Faye8.5 High
- pagerduty rundeckIDOR can reveal execution data and logs to unauthorized user in Rundeck6.5 Medium
- gitlabGitLab 12.6 through 12.9 is vulnerable to a privilege escalation that allows an external user to...5.3 Medium
- gitlabGitLab 9.5.9 through 12.9 is vulnerable to stored XSS in an admin notification feature.4.8 Medium
- gitlabGitLab 10.8 through 12.9 has a vulnerability that allows someone to mirror a repository even if...5.3 Medium
- ninjaforms ninja formsThe ninja-forms plugin before 3.4.24.2 for WordPress allows CSRF with resultant XSS.6.1 Medium
- php-fusionPHP-Fusion 9.03.50 allows SQL Injection because maincore.php has an insufficient protection...8.8 High
- grafana, fedoraproject fedora, redhat ceph storage +1 more +3 moreGrafana information disclosure5.5 Medium
- grafana, fedoraproject fedora +1 moreGrafana world readable configuration files5.5 Medium
- pega platformPega Platform before version 8.2.6 is affected by a Stored Cross-Site Scripting (XSS)...8.9 High
- inogard activex, inogard co,,ltd ebiz4u activex of inogard co,,ltd(axecm.cab) on windows 7/8/10 +1 moreAxECM.cab(ActiveX Control) in Inogard Ebiz4u contains a vulnerability that could allow remote...7.2 High
- handysoft groupware, groupware(hshell.dll) for for windows 7, 8, 10 +1 moreActiveX Control(HShell.dll) in Handy Groupware 1.7.3.1 for Windows 7, 8, and 10 allows an...6.4 Medium
- oracle vm virtualboxVulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core)....7.5 High
- pega platformThe Richtext Editor in Pega Platform before 8.2.6 is affected by a Stored Cross-Site Scripting ...8.9 High
- pega platformPega Platform before version 8.2.6 is affected by a Reflected Cross-Site Scripting vulnerability...8.8 High
- cerner medicoCerner medico 26.00 has a Local Buffer Overflow (issue 3 of 3).8.8 High
- gskill trident z lighting controlThe ene.sys driver in G.SKILL Trident Z Lighting Control through 1.00.08 exposes mapping and un...7.8 High
- cerner medicoCerner medico 26.00 has a Local Buffer Overflow (issue 2 of 3).8.8 High
- cerner medicoCerner medico 26.00 has a Local Buffer Overflow (issue 1 of 3).8.8 High
- cerner medicoCerner medico 26.00 allows variable reuse, possibly causing data corruption.8.8 High
- Show moreLoading…