Skip to content
OpenAdvisories

Archive

April 2020

Vulnerabilities first published in this month (UTC), newest first.

← March 2020 2020 / April May 2020 →
  1. 1108
  2. 256
  3. 326
  4. 48
  5. 51
  6. 643
  7. 7126
  8. 8139
  9. 930
  10. 1017
  11. 11 
  12. 1217
  13. 1342
  14. 1474
  15. 15513
  16. 16167
  17. 1774
  18. 181
  19. 194
  20. 2064
  21. 2165
  22. 22127
  23. 2393
  24. 2470
  25. 25 
  26. 263
  27. 2786
  28. 2899
  29. 2983
  30. 3055
All Critical High Medium Low Exploited only Public exploit

9 results · Clear filters · Feed

  • Medium 6.5
    CVE-2020-11652 Exploited Public exploit EPSS 86%

    SaltStack Salt is vulnerable Arbitrary Directory Access

    An issue was discovered in SaltStack Salt before 2019.2.4 and 3000 before 3000.2. The salt-master process ClearFuncs class allows access to some methods that improperly sanitize paths. These methods allow arbitrary directory access to authenticated users.

    salt salt salt Ubuntu Alpine PyPI
    KEV Nov 3, 2021
  • Medium 6.1
    CVE-2020-11027 Public exploit EPSS 14%

    Password reset links invalidation issue in WordPress

    In affected versions of WordPress, a password reset link emailed to a user does not expire upon changing the user password. Access would be needed to the email account of the user by a malicious party for successful execution. This has been patched in version…

    WordPress WordPress wordpress wordpress Web / CMS Debian Ubuntu
  • Medium 6.9
    CVE-2020-11023 Exploited Public exploit EPSS 85%

    Potential XSS vulnerability in jQuery

    In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing <option> elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute unt…

    jquery jQuery drupal7 cacti Debian Ubuntu Alpine npm Packagist Maven NuGet RubyGems
    KEV Jan 23, 2025
  • Medium 6.9
    CVE-2020-11022 Public exploit EPSS 99%

    jQuery has a potential XSS vulnerability

    In jQuery starting with 1.12.0 and before 3.5.0, passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3…

    jquery jQuery keycloak-26.6-iamguarded-compat drupal7 Debian Ubuntu Alpine Wolfi npm Packagist Maven NuGet RubyGems
  • Medium 6.5
    CVE-2019-15793 Public exploit

    Mishandling of file-system uid/gid with namespaces in shiftfs

    In shiftfs, a non-upstream patch to the Linux kernel included in the Ubuntu 5.0 and 5.3 kernel series, several locations which shift ids translate user/group ids before performing operations in the lower filesystem were translating them into init_user_ns, whe…

    Ubuntu Shiftfs in the Linux kernel linux-raspi2 linux-riscv Linux Ubuntu
  • Medium 6.1
    CVE-2020-7350 Public exploit

    Metasploit Framework Plugin Libnotify Command Injection

    Rapid7 Metasploit Framework versions before 5.0.85 suffers from an instance of CWE-78: OS Command Injection, wherein the libnotify plugin accepts untrusted user-supplied data via a remote computer's hostname or service name. An attacker can create a specially…

    Rapid7 Metasploit Framework
  • Medium 5.3
    CVE-2020-11883 Public exploit EPSS 15%

    Diavante vue-storefront-api and storefront-api disclose stack trace

    In Divante vue-storefront-api through 1.11.1 and storefront-api through 1.0-rc.1, as used in VueStorefront PWA, unexpected HTTP requests lead to an exception that discloses the error stack trace, with absolute file paths and Node.js module names.

    storefront-api vue-storefront-api npm
  • Medium 6.5
    CVE-2020-1958 Public exploit

    Credentials bypass in Apache Druid

    When LDAP authentication is enabled in Apache Druid 0.17.0, callers of Druid APIs with a valid set of LDAP credentials can bypass the credentialsValidator.userSearch filter barrier that determines if a valid LDAP user is allowed to authenticate with Druid. Th…

    Apache Apache Druid org.apache.druid:druid Maven
  • Medium —
    CVE-2019-17564 Public exploit Scanner template EPSS 37%

    Deserialization of Untrusted Data in Apache Dubbo

    Unsafe deserialization occurs within a Dubbo application which has HTTP remoting enabled. An attacker may submit a POST request with a Java object in it to completely compromise a Provider instance of Apache Dubbo, if this instance enables HTTP. This issue af…

    Apache Apache Dubbo org.apache.dubbo:dubbo-rpc-http-invoker Maven