Skip to content
Noroxi

By publication date

Exploited and new serious CVEs: April 2020

105 records · 16 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

Page 1 of 2

  • CVE-2020-11455
    68This week

    LimeSurvey before 4.1.12+200324 contains a path traversal vulnerability in application/controllers/admin/LimeSurveyFileManager.php.

    CriticalCVSS 9.8WeaponizedEPSS 97%

    limesurvey · limesurveyApr 1, 2020

  • CVE-2020-11456
    42Plan

    LimeSurvey before 4.1.12+200324 has stored XSS in application/views/admin/surveysgroups/surveySettings.php and application/models/SurveysGro

    MediumCVSS 5.4Proof of conceptEPSS 70%

    limesurvey · limesurveyApr 1, 2020

  • CVE-2020-10199
    95Now

    Sonatype Nexus Repository before 3.21.2 allows JavaEL Injection (issue 1 of 2).

    HighCVSS 8.8KEVWeaponizedEPSS 99%

    sonatype · nexusApr 1, 2020

  • CVE-2020-10204
    40Plan

    Sonatype Nexus Repository before 3.21.2 allows Remote Code Execution.

    HighCVSS 7.2Proof of conceptEPSS 38%

    sonatype · nexusApr 1, 2020

  • CVE-2020-1943
    53Plan

    Data sent with contentId to /control/stream is not sanitized, allowing XSS attacks in Apache OFBiz 16.11.01 to 16.11.07.

    MediumCVSS 6.1Proof of conceptEPSS 97%

    apache · ofbizApr 1, 2020

  • CVE-2020-1934
    37Monitor

    In Apache HTTP Server 2.4.0 to 2.4.41, mod_proxy_ftp may use uninitialized memory when proxying to a malicious FTP server.

    MediumCVSS 5.3No exploitEPSS 51%

    apache · http serverApr 1, 2020

  • CVE-2019-17564
    50Plan

    Unsafe deserialization occurs within a Dubbo application which has HTTP remoting enabled.

    CriticalCVSS 9.8Proof of conceptEPSS 36%

    apache · dubboApr 1, 2020

  • CVE-2020-1927
    41Plan

    In Apache HTTP Server 2.4.0 to 2.4.41, redirects configured with mod_rewrite that were intended to be self-referential might be fooled by en

    MediumCVSS 6.1No exploitEPSS 56%

    apache · http serverApr 1, 2020

  • CVE-2020-11491
    40Plan

    Monitoring::Logs in Zen Load Balancer 3.10.1 allows remote authenticated admins to conduct absolute path traversal attacks, as demonstrated

    MediumCVSS 4.9WeaponizedEPSS 7%

    zevenet · zen load balancerApr 2, 2020

  • CVE-2020-11100
    53Plan

    In hpack_dht_insert in hpack-tbl.c in the HPACK decoder in HAProxy 1.8 through 2.x before 2.1.4, a remote attacker can write arbitrary bytes

    HighCVSS 8.8No exploitEPSS 61%

    haproxy · haproxyApr 2, 2020

  • CVE-2020-11450
    35Monitor

    Microstrategy Web 10.4 exposes the JVM configuration, CPU architecture, installation folder, and other information through the URL /MicroStr

    HighCVSS 7.5Proof of conceptEPSS 17%

    microstrategy · microstrategy webApr 2, 2020

  • CVE-2020-11107
    42Plan

    An issue was discovered in XAMPP before 7.2.29, 7.3.x before 7.3.16 , and 7.4.x before 7.4.4 on Windows.

    HighCVSS 8.8Proof of conceptEPSS 22%

    apachefriends · xamppApr 2, 2020

  • CVE-2020-8639
    40Plan

    An unrestricted file upload vulnerability in keywordsImport.php in TestLink 1.9.20 allows remote attackers to execute arbitrary code by uplo

    HighCVSS 8.8Proof of conceptEPSS 15%

    testlink · testlinkApr 3, 2020

  • CVE-2020-8143
    45Plan

    An Open Redirect vulnerability was discovered in Revive Adserver version < 5.0.5 and reported by HackerOne user hoangn144.

    MediumCVSS 6.1No exploitEPSS 70%

    revive-adserver · revive adserverApr 3, 2020

  • CVE-2020-11518
    45Plan

    Zoho ManageEngine ADSelfService Plus before 5815 allows unauthenticated remote code execution.

    CriticalCVSS 9.8No exploitEPSS 19%

    zohocorp · manageengine adselfservice plusApr 4, 2020

  • CVE-2020-11529
    27Monitor

    Common/Grav.php in Grav before 1.7 has an Open Redirect.

    MediumCVSS 6.1Proof of conceptEPSS 10%

    getgrav · gravApr 4, 2020

  • CVE-2020-11547
    37Monitor

    PRTG Network Monitor before 20.1.57.1745 allows remote unauthenticated attackers to obtain information about probes running or the server it

    MediumCVSS 5.3Proof of conceptEPSS 52%

    paessler · prtg network monitorApr 4, 2020

  • CVE-2019-19699
    40Plan

    There is Authenticated remote code execution in Centreon Infrastructure Monitoring Software through 19.10 via Pollers misconfiguration, lead

    HighCVSS 7.2WeaponizedEPSS 27%

    centreon · centreonApr 6, 2020

  • CVE-2020-5734
    38Monitor

    Classic buffer overflow in SolarWinds Dameware allows a remote, unauthenticated attacker to cause a denial of service by sending a large 'Si

    HighCVSS 7.5No exploitEPSS 25%

    solarwinds · damewareApr 7, 2020

  • CVE-2020-5735
    76This week

    Amcrest cameras and NVR are vulnerable to a stack-based buffer overflow over port 37777.

    HighCVSS 8.8KEVWeaponizedEPSS 36%

    amcrest · 1080-lite 8ch firmwareApr 8, 2020

  • CVE-2020-10977
    40Plan

    GitLab EE/CE 8.5 to 12.9 is vulnerable to a an path traversal when moving an issue between projects.

    MediumCVSS 5.5WeaponizedEPSS 42%

    gitlab · gitlabApr 8, 2020

  • CVE-2020-10619
    40Plan

    An attacker could use a specially crafted URL to delete files outside the WebAccess/NMS's (versions prior to 3.0.2) control.

    CriticalCVSS 9.1No exploitEPSS 14%

    advantech · webaccess\/nmsApr 9, 2020

  • CVE-2020-3952
    96Now

    Under certain conditions, vmdir that ships with VMware vCenter Server, as part of an embedded or external Platform Services Controller (PSC)

    CriticalCVSS 9.8KEVWeaponizedEPSS 90%

    vmware · vcenter serverApr 10, 2020

  • CVE-2020-5330
    34Monitor

    Dell EMC Networking X-Series firmware versions 3.0.1.2 and older, Dell EMC Networking PC5500 firmware versions 4.1.0.22 and older and Dell E

    HighCVSS 7.5Proof of conceptEPSS 13%

    dell · r1-2210 firmwareApr 10, 2020

  • CVE-2020-11710
    49Plan

    An issue was discovered in docker-kong (for Kong) through 2.0.3.

    CriticalCVSS 9.8Proof of conceptEPSS 33%

    konghq · docker-kongApr 12, 2020

  • CVE-2020-11738
    89Now

    The Snap Creek Duplicator plugin before 1.3.28 for WordPress (and Duplicator Pro before 3.8.7.1) allows Directory Traversal via ../ in the f

    HighCVSS 7.5KEVWeaponizedEPSS 97%

    awesomemotive · duplicatorApr 13, 2020

  • CVE-2020-2733
    45Plan

    Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Monitoring and Diagnostics).

    CriticalCVSS 9.8Proof of conceptEPSS 18%

    oracle · jd edwards enterpriseone toolsApr 15, 2020

  • CVE-2020-2852
    52Plan

    Vulnerability in the Oracle Advanced Outbound Telephony product of Oracle E-Business Suite (component: Calendar).

    HighCVSS 8.2No exploitEPSS 66%

    oracle · advanced outbound telephonyApr 15, 2020

  • CVE-2020-2854
    52Plan

    Vulnerability in the Oracle Advanced Outbound Telephony product of Oracle E-Business Suite (component: User Interface).

    HighCVSS 8.2No exploitEPSS 66%

    oracle · advanced outbound telephonyApr 15, 2020

  • CVE-2020-2871
    52Plan

    Vulnerability in the Oracle Advanced Outbound Telephony product of Oracle E-Business Suite (component: User Interface).

    HighCVSS 8.2No exploitEPSS 66%

    oracle · advanced outbound telephonyApr 15, 2020

  • CVE-2020-2882
    46Plan

    Vulnerability in the Oracle Human Resources product of Oracle E-Business Suite (component: Hierarchy Diagrammers).

    HighCVSS 8.1No exploitEPSS 46%

    oracle · human resourcesApr 15, 2020

  • CVE-2020-2883
    97Now

    Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core).

    CriticalCVSS 9.8KEVWeaponizedEPSS 94%

    oracle · weblogic serverApr 15, 2020

  • CVE-2020-2950
    60This week

    Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Fusion Middleware (component: Analytics Web General).

    CriticalCVSS 9.8Proof of conceptEPSS 71%

    oracle · business intelligenceApr 15, 2020

  • CVE-2020-0687
    41Plan

    A remote code execution vulnerability exists when the Windows font library improperly handles specially crafted embedded fonts, aka 'Microso

    HighCVSS 8.8No exploitEPSS 19%

    microsoft · windows 10Apr 15, 2020

  • CVE-2020-0889
    35Monitor

    A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database En

    HighCVSS 7.8No exploitEPSS 11%

    microsoft · windows 10Apr 15, 2020

  • CVE-2020-0906
    38Monitor

    A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory, aka '

    HighCVSS 8.8No exploitEPSS 11%

    microsoft · excelApr 15, 2020

  • CVE-2020-0907
    35Monitor

    A remote code execution vulnerability exists in the way that Microsoft Graphics Components handle objects in memory, aka 'Microsoft Graphics

    HighCVSS 7.8No exploitEPSS 11%

    microsoft · windows 10Apr 15, 2020

  • CVE-2020-0920
    38Monitor

    A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application pa

    HighCVSS 8.8No exploitEPSS 10%

    microsoft · sharepoint enterprise serverApr 15, 2020

  • CVE-2020-0929
    38Monitor

    A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application pa

    HighCVSS 8.8No exploitEPSS 10%

    microsoft · sharepoint enterprise serverApr 15, 2020

  • CVE-2020-0931
    38Monitor

    A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application pa

    HighCVSS 8.8No exploitEPSS 10%

    microsoft · business productivity serversApr 15, 2020

  • CVE-2020-0932
    46Plan

    A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application pa

    HighCVSS 8.8No exploitEPSS 35%

    microsoft · sharepoint enterprise serverApr 15, 2020

  • CVE-2020-0938
    82Now

    A remote code execution vulnerability exists in Microsoft Windows when the Windows Adobe Type Manager Library improperly handles a specially

    HighCVSS 7.8KEVWeaponizedEPSS 68%

    microsoft · windows 10 1507Apr 15, 2020

  • CVE-2020-0953
    35Monitor

    A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database En

    HighCVSS 7.8No exploitEPSS 11%

    microsoft · windows 10Apr 15, 2020

  • CVE-2020-0959
    35Monitor

    A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database En

    HighCVSS 7.8No exploitEPSS 11%

    microsoft · windows 10Apr 15, 2020

  • CVE-2020-0960
    35Monitor

    A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database En

    HighCVSS 7.8No exploitEPSS 11%

    microsoft · windows 10Apr 15, 2020

  • CVE-2020-0961
    35Monitor

    A remote code execution vulnerability exists when the Microsoft Office Access Connectivity Engine improperly handles objects in memory, aka

    HighCVSS 7.8No exploitEPSS 11%

    microsoft · officeApr 15, 2020

  • CVE-2020-0964
    41Plan

    A remote code execution vulnerability exists in the way that the Windows Graphics Device Interface (GDI) handles objects in the memory, aka

    HighCVSS 8.8No exploitEPSS 18%

    microsoft · windows 10Apr 15, 2020

  • CVE-2020-0966
    39Monitor

    A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory, aka 'VBScript Remote Code Execut

    HighCVSS 8.8No exploitEPSS 11%

    microsoft · internet explorerApr 15, 2020

  • CVE-2020-0967
    39Monitor

    A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory, aka 'VBScript Remote Code Execut

    HighCVSS 8.8No exploitEPSS 11%

    microsoft · internet explorerApr 15, 2020

  • CVE-2020-0968
    69This week

    A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka 'Scrip

    HighCVSS 7.5KEVWeaponizedEPSS 30%

    microsoft · internet explorerApr 15, 2020

  • CVE-2020-0969
    34Monitor

    A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge (HTML-b

    HighCVSS 7.5No exploitEPSS 13%

    microsoft · edgeApr 15, 2020

  • CVE-2020-0970
    34Monitor

    A remote code execution vulnerability exists in the way that the ChakraCore scripting engine handles objects in memory, aka 'Scripting Engin

    HighCVSS 7.5No exploitEPSS 13%

    microsoft · chakracoreApr 15, 2020

  • CVE-2020-0971
    39Monitor

    A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application pa

    HighCVSS 8.8No exploitEPSS 13%

    microsoft · sharepoint enterprise serverApr 15, 2020

  • CVE-2020-0974
    38Monitor

    A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application pa

    HighCVSS 8.8No exploitEPSS 10%

    microsoft · sharepoint enterprise serverApr 15, 2020

  • CVE-2020-0979
    38Monitor

    A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory, aka '

    HighCVSS 8.8No exploitEPSS 11%

    microsoft · office 365 proplusApr 15, 2020

  • CVE-2020-0980
    35Monitor

    A remote code execution vulnerability exists in Microsoft Word software when it fails to properly handle objects in memory, aka 'Microsoft W

    HighCVSS 7.8No exploitEPSS 11%

    microsoft · officeApr 15, 2020

  • CVE-2020-0988
    35Monitor

    A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database En

    HighCVSS 7.8No exploitEPSS 11%

    microsoft · windows 10Apr 15, 2020

  • CVE-2020-0991
    35Monitor

    A remote code execution vulnerability exists in Microsoft Office software when the software fails to properly handle objects in memory, aka

    HighCVSS 7.8No exploitEPSS 11%

    microsoft · officeApr 15, 2020

  • CVE-2020-0992
    35Monitor

    A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database En

    HighCVSS 7.8No exploitEPSS 11%

    microsoft · windows 10Apr 15, 2020

  • CVE-2020-0994
    35Monitor

    A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database En

    HighCVSS 7.8No exploitEPSS 11%

    microsoft · windows 10Apr 15, 2020

  • CVE-2020-0995
    36Monitor

    A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database En

    HighCVSS 7.8No exploitEPSS 17%

    microsoft · windows 10Apr 15, 2020

  • CVE-2020-0999
    35Monitor

    A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database En

    HighCVSS 7.8No exploitEPSS 11%

    microsoft · windows 10Apr 15, 2020

  • CVE-2020-1008
    35Monitor

    A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database En

    HighCVSS 7.8No exploitEPSS 11%

    microsoft · windows 10Apr 15, 2020

  • CVE-2020-1020
    85Now

    A remote code execution vulnerability exists in Microsoft Windows when the Windows Adobe Type Manager Library improperly handles a specially

    HighCVSS 8.8KEVWeaponizedEPSS 65%

    microsoft · windows 10 1507Apr 15, 2020

  • CVE-2020-1027
    62This week

    An elevation of privilege vulnerability exists in the way that the Windows Kernel handles objects in memory, aka 'Windows Kernel Elevation o

    HighCVSS 7.8KEVWeaponizedEPSS 4%

    microsoft · windows 10 1507Apr 15, 2020

  • CVE-2020-3161
    94Now

    Cisco IP Phones Web Server Remote Code Execution and Denial of Service Vulnerability

    CriticalCVSS 9.8KEVWeaponizedEPSS 83%

    cisco · ip phone 8865 firmwareApr 15, 2020

  • CVE-2020-3239
    57Plan

    Multiple Vulnerabilities in Cisco UCS Director and Cisco UCS Director Express for Big Data

    HighCVSS 8.8No exploitEPSS 73%

    cisco · ucs directorApr 15, 2020

  • CVE-2020-3240
    41Plan

    Multiple Vulnerabilities in Cisco UCS Director and Cisco UCS Director Express for Big Data

    HighCVSS 7.3No exploitEPSS 38%

    cisco · ucs directorApr 15, 2020

  • CVE-2020-3243
    66This week

    Multiple Vulnerabilities in Cisco UCS Director and Cisco UCS Director Express for Big Data

    CriticalCVSS 9.8WeaponizedEPSS 88%

    cisco · ucs directorApr 15, 2020

  • CVE-2020-3247
    62This week

    Multiple Vulnerabilities in Cisco UCS Director and Cisco UCS Director Express for Big Data

    CriticalCVSS 9.8No exploitEPSS 75%

    cisco · ucs directorApr 15, 2020

  • CVE-2020-3248
    61This week

    Multiple Vulnerabilities in Cisco UCS Director and Cisco UCS Director Express for Big Data

    CriticalCVSS 9.8No exploitEPSS 74%

    cisco · ucs directorApr 15, 2020

  • CVE-2020-3249
    37Monitor

    Multiple Vulnerabilities in Cisco UCS Director and Cisco UCS Director Express for Big Data

    HighCVSS 7.5No exploitEPSS 23%

    cisco · ucs directorApr 15, 2020

  • CVE-2020-3250
    60This week

    Multiple Vulnerabilities in Cisco UCS Director and Cisco UCS Director Express for Big Data

    CriticalCVSS 9.8WeaponizedEPSS 60%

    cisco · ucs directorApr 15, 2020

  • CVE-2020-3251
    53Plan

    Multiple Vulnerabilities in Cisco UCS Director and Cisco UCS Director Express for Big Data

    HighCVSS 8.8No exploitEPSS 61%

    cisco · ucs directorApr 15, 2020

  • CVE-2020-11819
    47Plan

    In Rukovoditel 2.5.2, an attacker may inject an arbitrary .php file location instead of a language file and thus achieve command execution.

    CriticalCVSS 9.8Proof of conceptEPSS 26%

    rukovoditel · rukovoditelApr 16, 2020

  • CVE-2020-11883
    26Monitor

    In Divante vue-storefront-api through 1.11.1 and storefront-api through 1.0-rc.1, as used in VueStorefront PWA, unexpected HTTP requests lea

    MediumCVSS 5.3Proof of conceptEPSS 15%

    divante · storefront-apiApr 17, 2020

  • CVE-2020-11886
    32Monitor

    OpenNMS Horizon and Meridian allows HQL Injection in element/nodeList.htm (aka the NodeListController) via snmpParm or snmpParmValue to addC

    HighCVSS 8.1No exploitEPSS 1%

    opennms · horizonApr 17, 2020

  • CVE-2020-11946
    46Plan

    Zoho ManageEngine OpManager before 125120 allows an unauthenticated user to retrieve an API key via a servlet call.

    HighCVSS 7.5No exploitEPSS 51%

    zohocorp · manageengine opmanagerApr 20, 2020

  • CVE-2020-1967
    46Plan

    Segmentation fault in SSL_check_chain

    HighCVSS 7.5Proof of conceptEPSS 53%

    openssl · opensslApr 21, 2020

  • CVE-2020-10914
    60This week

    This vulnerability allows remote attackers to execute arbitrary code on affected installations of VEEAM One Agent 9.5.4.4587.

    CriticalCVSS 9.8WeaponizedEPSS 47%

    veeam · oneApr 22, 2020

  • CVE-2020-10915
    65This week

    This vulnerability allows remote attackers to execute arbitrary code on affected installations of VEEAM One Agent 9.5.4.4587.

    CriticalCVSS 9.8WeaponizedEPSS 86%

    veeam · oneApr 22, 2020

  • CVE-2020-7350
    40Plan

    Metasploit Framework Plugin Libnotify Command Injection

    HighCVSS 7.8WeaponizedEPSS 5%

    rapid7 · metasploitApr 22, 2020

  • CVE-2020-11940
    30Monitor

    In nDPI through 3.2 Stable, an out-of-bounds read in concat_hash_string in ssh.c can be exploited by a network-positioned attacker that can

    HighCVSS 7.5No exploitEPSS 1%

    ntop · ndpiApr 23, 2020

  • CVE-2020-11945
    47Plan

    An issue was discovered in Squid before 5.0.2.

    CriticalCVSS 9.8No exploitEPSS 27%

    squid-cache · squidApr 23, 2020

  • CVE-2020-6819
    63This week

    Under certain conditions, when running the nsDocShell destructor, a race condition can cause a use-after-free.

    HighCVSS 8.1KEVWeaponizedEPSS 3%

    mozilla · firefoxApr 24, 2020

  • CVE-2020-6820
    64This week

    Under certain conditions, when handling a ReadableStream, a race condition can cause a use-after-free.

    HighCVSS 8.1KEVWeaponizedEPSS 7%

    mozilla · firefoxApr 24, 2020

  • CVE-2020-12271
    82Now

    A SQL injection issue was found in SFOS 17.0, 17.1, 17.5, and 18.0 before 2020-04-25 on Sophos XG Firewall devices, as exploited in the wild

    CriticalCVSS 9.8KEVWeaponizedEPSS 42%

    sophos · sfosApr 27, 2020

  • CVE-2020-12133
    42Plan

    The Apros Evolution, ConsciusMap, and Furukawa provisioning systems through 2.8.1 allow remote code execution because of javax.faces.ViewSta

    CriticalCVSS 9.8No exploitEPSS 10%

    farukawa · electric consciousmapApr 27, 2020

  • CVE-2020-12138
    36Monitor

    AMD ATI atillk64.sys 5.11.9.0 allows low-privileged users to interact directly with physical memory by calling one of several driver routine

    HighCVSS 8.8No exploitEPSS 3%

    amd · atillk64Apr 27, 2020

  • CVE-2020-9294
    62This week

    An improper authentication vulnerability in FortiMail 5.4.10, 6.0.7, 6.2.2 and earlier and FortiVoiceEntreprise 6.0.0 and 6.0.1 may allow a

    CriticalCVSS 9.8WeaponizedEPSS 77%

    fortinet · fortimailApr 27, 2020

  • CVE-2020-1745
    40Plan

    A file inclusion vulnerability was found in the AJP connector enabled with a default AJP configuration port of 8009 in Undertow version 2.0.

    CriticalCVSS 9.8No exploitEPSS 4%

    redhat · undertowApr 28, 2020

  • CVE-2020-8471
    31Monitor

    ABB Central Licensing System - Weak File Permissions

    HighCVSS 7.8No exploitEPSS 0%

    abb · 800xa systemApr 28, 2020

  • CVE-2020-12447
    34Monitor

    A Local File Inclusion (LFI) issue on Onkyo TX-NR585 1000-0000-000-0008-0000 devices allows remote unauthenticated users on the network to r

    HighCVSS 7.5Proof of conceptEPSS 13%

    onkyo · tx-nr585 firmwareApr 28, 2020

  • CVE-2020-11023
    79This week

    Potential XSS vulnerability in jQuery

    MediumCVSS 6.1KEVWeaponizedEPSS 84%

    jquery · jqueryApr 29, 2020

  • CVE-2020-11022
    54Plan

    jQuery has a potential XSS vulnerability

    MediumCVSS 6.1Proof of conceptEPSS 99%

    jquery · jqueryApr 29, 2020

  • CVE-2020-11943
    42Plan

    An issue was discovered in Open-AudIT 3.2.2.

    HighCVSS 8.8No exploitEPSS 23%

    opmantek · open-auditApr 29, 2020

  • CVE-2019-5618
    40Plan

    A-PDF WAV to MP3 Stack-based Buffer Overflow

    HighCVSS 7.8WeaponizedEPSS 2%

    a-pdf · wav to mp3Apr 29, 2020

  • CVE-2019-5619
    60This week

    AASync.com AASync Stack-based Buffer Overflow

    CriticalCVSS 9.8WeaponizedEPSS 4%

    aasync · aasyncApr 29, 2020

  • CVE-2019-5620
    60This week

    ABB MicroSCADA Pro SYS600 Missing Authentication for Critical Function

    CriticalCVSS 9.8WeaponizedEPSS 70%

    hitachienergy · microscada pro sys600Apr 29, 2020

  • CVE-2020-6010
    50Plan

    LearnPress Wordpress plugin version prior and including 3.2.6.7 is vulnerable to SQL Injection

    HighCVSS 8.8WeaponizedEPSS 49%

    thimpress · learnpressApr 30, 2020