Security Vulnerabilities - CVEs Published In April 2020
In BD Pyxis MedStation ES System v1.6.1 and Pyxis Anesthesia (PAS) ES System v1.6.1, a restricted desktop environment escape vulnerability exists in the kiosk mode functionality of affected devices. Specially crafted inputs could allow the user to escape the restricted environment, resulting in access to sensitive data.
CVSS Score
6.1
EPSS Score
0.001
Published
2020-04-01
Jon Hedley AlienForm2 (typically installed as af.cgi or alienform.cgi) 2.0.2 is vulnerable to Remote Command Execution via eval injection, a different issue than CVE-2002-0934. An unauthenticated, remote attacker can exploit this via a series of crafted requests.
CVSS Score
9.8
EPSS Score
0.181
Published
2020-04-01
In Apache HTTP Server 2.4.0 to 2.4.41, mod_proxy_ftp may use uninitialized memory when proxying to a malicious FTP server.
CVSS Score
5.3
EPSS Score
0.419
Published
2020-04-01
In RedpwnCTF before version 2.3, there is a session fixation vulnerability in exploitable through the `#token=$ssid` hash when making a request to the `/verify` endpoint. An attacker team could potentially steal flags by, for example, exploiting a stored XSS payload in a CTF challenge so that victim teams who solve the challenge are unknowingly (and against their will) signed into the attacker team's account. Then, the attacker can gain points / value off the backs of the victims. This is patched in version 2.3.
CVSS Score
6.5
EPSS Score
0.002
Published
2020-04-01
CVE-2020-10199
Sonatype Nexus Repository before 3.21.2 allows JavaEL Injection (issue 1 of 2).
Known exploited
CVSS Score
8.8
EPSS Score
0.944
Published
2020-04-01
Sonatype Nexus Repository before 3.21.2 allows XSS.
CVSS Score
4.8
EPSS Score
0.004
Published
2020-04-01
Sonatype Nexus Repository before 3.21.2 allows Remote Code Execution.
CVSS Score
7.2
EPSS Score
0.541
Published
2020-04-01
Data sent with contentId to /control/stream is not sanitized, allowing XSS attacks in Apache OFBiz 16.11.01 to 16.11.07.
CVSS Score
6.1
EPSS Score
0.84
Published
2020-04-01
Scripts in Sling CMS before 0.16.0 do not property escape the Sling Selector from URLs when generating navigational elements for the administrative consoles and are vulnerable to reflected XSS attacks.
CVSS Score
6.1
EPSS Score
0.018
Published
2020-04-01
An out-of-bounds read was addressed with improved input validation. This issue is fixed in macOS Catalina 10.15.3. A remote attacker may be able to leak memory.
CVSS Score
9.8
EPSS Score
0.013
Published
2020-04-01