# CVEs published 2020-05-06

72 CVEs were published on May 6, 2020: 6 critical, 20 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2020-12689](https://cve.now/CVE-2020-12689.md): An issue was discovered in OpenStack Keystone before 15.0.1, and 16.0.0. (no CVSS, keystone)
- [CVE-2020-12690](https://cve.now/CVE-2020-12690.md): An issue was discovered in OpenStack Keystone before 15.0.1, and 16.0.0. (no CVSS, keystone)
- [CVE-2020-12691](https://cve.now/CVE-2020-12691.md): An issue was discovered in OpenStack Keystone before 15.0.1, and 16.0.0. (no CVSS, keystone)
- [CVE-2020-12692](https://cve.now/CVE-2020-12692.md): An issue was discovered in OpenStack Keystone before 15.0.1, and 16.0.0. (no CVSS, keystone)
- [CVE-2020-12669](https://cve.now/CVE-2020-12669.md): core/get\_menudiv.php in Dolibarr before 11.0.4 allows remote authenticated attackers to bypass intended access restrictions via a… (no CVSS, dolibarr/dolibarr)
- [CVE-2018-8956](https://cve.now/CVE-2018-8956.md): ntpd in ntp 4.2.8p10, 4.2.8p11, 4.2.8p12 and 4.2.8p13 allow remote attackers to prevent a broadcast client from synchronizing its clock… (no CVSS)
- [CVE-2020-11727](https://cve.now/CVE-2020-11727.md): A cross-site scripting (XSS) vulnerability in the AlgolPlus Advanced Order Export For WooCommerce plugin 3.1.3 for WordPress allows remote… (no CVSS)
- [CVE-2020-3308](https://cve.now/CVE-2020-3308.md): Cisco Firepower Threat Defense Software Signature Verification Bypass Vulnerability (CVSS 4.9, Cisco Firepower Threat Defense Software)
- [CVE-2020-3307](https://cve.now/CVE-2020-3307.md): Cisco Firepower Management Center Arbitrary Log File Write Vulnerability (CVSS 5.3, Cisco Firepower Management Center)
- [CVE-2020-3306](https://cve.now/CVE-2020-3306.md): Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software DHCP Denial of Service Vulnerability (CVSS 6.8, Cisco Adaptive Security Appliance (ASA) Software)
- [CVE-2020-3305](https://cve.now/CVE-2020-3305.md): Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software BGP Denial of Service Vulnerability (CVSS 6.8, Cisco Adaptive Security Appliance (ASA) Software)
- [CVE-2020-3303](https://cve.now/CVE-2020-3303.md): Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software IKEv1 Denial of Service Vulnerability (CVSS 6.8, Cisco Adaptive Security Appliance (ASA) Software)
- [CVE-2020-3302](https://cve.now/CVE-2020-3302.md): Cisco Firepower Management Center File Overwrite Vulnerability (CVSS 6.8, Cisco Firepower Management Center)
- [CVE-2020-3301](https://cve.now/CVE-2020-3301.md): Cisco Firepower Management Center Static Credential Vulnerabilities (CVSS 8.1, Cisco Firepower Management Center)
- [CVE-2020-3298](https://cve.now/CVE-2020-3298.md): Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software Malformed OSPF Packets Processing Denial of Service… (CVSS 8.6, Cisco Adaptive Security Appliance (ASA) Software)
- [CVE-2020-3285](https://cve.now/CVE-2020-3285.md): Cisco Firepower Threat Defense Software SSL/TLS URL Category Bypass Vulnerability (CVSS 5.8, Cisco Firepower Threat Defense Software)
- [CVE-2020-3283](https://cve.now/CVE-2020-3283.md): Cisco Firepower 1000 Series SSL/TLS Denial of Service Vulnerability (CVSS 8.6, Cisco Firepower Threat Defense Software)
- [CVE-2020-3259](https://cve.now/CVE-2020-3259.md): Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software Web Services Information Disclosure Vulnerability (CVSS 7.5, KEV, Cisco Adaptive Security Appliance (ASA) Software)
- [CVE-2020-3256](https://cve.now/CVE-2020-3256.md): Cisco Hosted Collaboration Mediation Fulfillment XML External Expansion Vulnerability (CVSS 4.9, Cisco Hosted Collaboration Mediation Fulfillment)
- [CVE-2020-3255](https://cve.now/CVE-2020-3255.md): Cisco Firepower Threat Defense Software Packet Flood Denial of Service Vulnerability (CVSS 7.5, Cisco Firepower Threat Defense Software)
- [CVE-2020-3254](https://cve.now/CVE-2020-3254.md): Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software Media Gateway Control Protocol Denial of Service… (CVSS 8.6, Cisco Adaptive Security Appliance (ASA) Software)
- [CVE-2020-3253](https://cve.now/CVE-2020-3253.md): Cisco Firepower Threat Defense Software Shell Access Vulnerability (CVSS 6.7, Cisco Firepower Threat Defense Software)
- [CVE-2020-3246](https://cve.now/CVE-2020-3246.md): Cisco Umbrella Carriage Return Line Feed Injection Vulnerability (CVSS 4.7, Cisco Umbrella)
- [CVE-2020-3196](https://cve.now/CVE-2020-3196.md): Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software SSL/TLS Denial of Service Vulnerability (CVSS 8.6, Cisco Adaptive Security Appliance (ASA) Software)
- [CVE-2020-3195](https://cve.now/CVE-2020-3195.md): Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software OSPF Packets Processing Memory Leak Vulnerability (CVSS 8.6, Cisco Adaptive Security Appliance (ASA) Software)
- [CVE-2020-3191](https://cve.now/CVE-2020-3191.md): Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software IPv6 DNS Denial of Service Vulnerability (CVSS 8.6, Cisco Adaptive Security Appliance (ASA) Software)
- [CVE-2020-3189](https://cve.now/CVE-2020-3189.md): Cisco Firepower Threat Defense Software VPN System Logging Denial of Service Vulnerability (CVSS 8.6, Cisco Firepower Threat Defense Software)
- [CVE-2020-3188](https://cve.now/CVE-2020-3188.md): Cisco Firepower Threat Defense Software Management Interface Denial of Service Vulnerability (CVSS 5.3, Cisco Firepower Threat Defense Software)
- [CVE-2020-3187](https://cve.now/CVE-2020-3187.md): Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software Web Services Path Traversal Vulnerability (CVSS 9.1, Cisco Adaptive Security Appliance (ASA) Software)
- [CVE-2020-3334](https://cve.now/CVE-2020-3334.md): Cisco Firepower 2100 Series Security Appliances ARP Denial of Service Vulnerability (CVSS 7.4, Cisco Adaptive Security Appliance (ASA) Software)
- [CVE-2020-3329](https://cve.now/CVE-2020-3329.md): Cisco IMC Supervisor, Cisco UCS Director, and Cisco UCS Director Express for Big Data Role-Based Access Control Vulnerability (CVSS 4.3, Cisco UCS Director)
- [CVE-2020-3318](https://cve.now/CVE-2020-3318.md): Cisco Firepower Management Center Static Credential Vulnerabilities (CVSS 8.1, Cisco Firepower Management Center)
- [CVE-2020-3315](https://cve.now/CVE-2020-3315.md): Multiple Cisco Products Snort HTTP Detection Engine File Policy Bypass Vulnerability (CVSS 5.8, Cisco Firepower Threat Defense Software)
- [CVE-2020-3313](https://cve.now/CVE-2020-3313.md): Cisco Firepower Management Center Cross-Site Scripting Vulnerability (CVSS 6.5, Cisco Firepower Management Center)
- [CVE-2020-3312](https://cve.now/CVE-2020-3312.md): Cisco Firepower Threat Defense Software Information Disclosure Vulnerability (CVSS 5.8, Cisco Firepower Threat Defense Software)
- [CVE-2020-3311](https://cve.now/CVE-2020-3311.md): Cisco Firepower Management Center Open Redirect Vulnerability (CVSS 4.3, Cisco Firepower Management Center)
- [CVE-2020-3310](https://cve.now/CVE-2020-3310.md): Cisco Firepower Device Manager On-Box Software XML Parsing Vulnerability (CVSS 5.5, Cisco Firepower Threat Defense Software)
- [CVE-2020-3309](https://cve.now/CVE-2020-3309.md): Cisco Firepower Device Manager On-Box Software Arbitrary File Overwrite Vulnerability (CVSS 6.5, Cisco Firepower Threat Defense Software)
- [CVE-2020-3125](https://cve.now/CVE-2020-3125.md): Cisco Adaptive Security Appliance Software Kerberos Authentication Bypass Vulnerability (CVSS 8.1, Cisco Adaptive Security Appliance (ASA) Software)
- [CVE-2020-3179](https://cve.now/CVE-2020-3179.md): Cisco Firepower Threat Defense Software Generic Routing Encapsulation Tunnel IPv6 Denial of Service Vulnerability (CVSS 8.6, Cisco Firepower Threat Defense Software)
- [CVE-2020-3178](https://cve.now/CVE-2020-3178.md): Cisco Content Security Management Appliance Open Redirect Vulnerabilities (CVSS 6.1, Cisco Content Security Management Appliance)
- [CVE-2020-3186](https://cve.now/CVE-2020-3186.md): Cisco Firepower Threat Defense Software Management Access List Bypass Vulnerability (CVSS 5.3, Cisco Firepower Threat Defense Software)
- [CVE-2020-8899](https://cve.now/CVE-2020-8899.md): Memory corruption in Quram library when decoding qmg can lead to RCE (CVSS 10.0, Samsung Android OS)
- [CVE-2020-7921](https://cve.now/CVE-2020-7921.md): Administrative action may disable enforcement of per-user IP whitelisting (CVSS 4.6, MongoDB Server)
- [CVE-2020-12108](https://cve.now/CVE-2020-12108.md): /options/mailman in GNU Mailman before 2.1.31 allows Arbitrary Content Injection. (no CVSS)
- [CVE-2020-4446](https://cve.now/CVE-2020-4446.md): IBM Business Process Manager 8.0, 8.5, and 8.6 and IBM Business Automation Workflow 18.0 and 19.0 could allow a remote attacker to bypass… (CVSS 4.3, IBM Business Process Manager Standard · IBM Business Automa…)
- [CVE-2020-4421](https://cve.now/CVE-2020-4421.md): IBM WebSphere Application Liberty 19.0.0.5 through 20.0.0.4 could allow an authenticated user using openidconnect to spoof another users… (CVSS 5.0, IBM WebSphere Application Server Liberty)
- [CVE-2020-4384](https://cve.now/CVE-2020-4384.md): IBM InfoSphere Information Server 11.3, 11.5, and 11.7 is vulnerable to cross-site scripting. (CVSS 5.4, IBM InfoSphere Information Server)
- [CVE-2019-4266](https://cve.now/CVE-2019-4266.md): IBM Maximo Anywhere 7.6.2.0, 7.6.2.1, 7.6.3.0, and 7.6.3.1 does not have device jailbreak detection which could result in an attacker… (CVSS 2.4, IBM Maximo Anywhere)
- [CVE-2020-6861](https://cve.now/CVE-2020-6861.md): A flawed protocol design in the Ledger Monero app before 1.5.1 for Ledger Nano and Ledger S devices allows a local attacker to extract the… (no CVSS)
- [CVE-2020-10693](https://cve.now/CVE-2020-10693.md): A flaw was found in Hibernate Validator version 6.1.2.Final. (CVSS 5.3, hibernate-validator · org.hibernate.validator:hibernate-… +1)
- [CVE-2019-19168](https://cve.now/CVE-2019-19168.md): Dext5.ocx ActiveX 5.0.0.116 and eariler versions contain a vulnerability, which could allow remote attacker to download and execute remote… (CVSS 7.8, RAONwiz Dext.ocx ActiveX Control in Dext5 Upload)
- [CVE-2019-19169](https://cve.now/CVE-2019-19169.md): Dext5.ocx ActiveX 5.0.0.116 and eariler versions contain a vulnerability, which could allow remote attacker to download arbitrary file by… (CVSS 7.8, RAONwiz Dext.ocx ActiveX Control in Dext5 Upload)
- [CVE-2020-7806](https://cve.now/CVE-2020-7806.md): Tobesoft Xplatform ActiveX File Download Vulnerability (CVSS 7.8, Tobesoft Xplatform)
- [CVE-2019-19167](https://cve.now/CVE-2019-19167.md): Tobesoft Nexacro14 ActiveX File Download Vulnerability (CVSS 7.8, Tobesoft Nexacro14)
- [CVE-2020-2189](https://cve.now/CVE-2020-2189.md): Jenkins SCM Filter Jervis Plugin 0.2.1 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types… (no CVSS, Jenkins project Jenkins SCM Filter Jervis Plugin · io.jenki…)
- [CVE-2020-2187](https://cve.now/CVE-2020-2187.md): Jenkins Amazon EC2 Plugin 1.50.1 and earlier unconditionally accepts self-signed certificates and does not perform hostname validation… (no CVSS, Jenkins project Jenkins Amazon EC2 Plugin · org.jenkins-ci.…)
- [CVE-2020-2188](https://cve.now/CVE-2020-2188.md): A missing permission check in Jenkins Amazon EC2 Plugin 1.50.1 and earlier in form-related methods allowed users with Overall/Read access… (no CVSS, Jenkins project Jenkins Amazon EC2 Plugin · org.jenkins-ci.…)
- [CVE-2020-2185](https://cve.now/CVE-2020-2185.md): Jenkins Amazon EC2 Plugin 1.50.1 and earlier does not validate SSH host keys when connecting agents, enabling man-in-the-middle attacks. (no CVSS, Jenkins project Jenkins Amazon EC2 Plugin · org.jenkins-ci.…)
- [CVE-2020-2186](https://cve.now/CVE-2020-2186.md): A cross-site request forgery vulnerability in Jenkins Amazon EC2 Plugin 1.50.1 and earlier allows attackers to provision instances. (no CVSS, Jenkins project Jenkins Amazon EC2 Plugin · org.jenkins-ci.…)
- [CVE-2020-2182](https://cve.now/CVE-2020-2182.md): Jenkins Credentials Binding Plugin 1.22 and earlier does not mask (i.e., replace with asterisks) secrets containing a \`$\` character in… (no CVSS, Jenkins project Jenkins Credentials Binding Plugin · org.je…)
- [CVE-2020-2183](https://cve.now/CVE-2020-2183.md): Jenkins Copy Artifact Plugin 1.43.1 and earlier performs improper permission checks, allowing attackers to copy artifacts from jobs they… (no CVSS, Jenkins project Jenkins Copy Artifact Plugin · org.jenkins-…)
- [CVE-2020-2184](https://cve.now/CVE-2020-2184.md): A cross-site request forgery vulnerability in Jenkins CVS Plugin 2.15 and earlier allows attackers to create and manipulate tags, and to… (no CVSS, Jenkins project Jenkins CVS Plugin · org.jenkins-ci.plugins…)
- [CVE-2020-2181](https://cve.now/CVE-2020-2181.md): Jenkins Credentials Binding Plugin 1.22 and earlier does not mask (i.e., replace with asterisks) secrets in the build log when the build… (no CVSS, Jenkins project Jenkins Credentials Binding Plugin · org.je…)
- [CVE-2019-19166](https://cve.now/CVE-2019-19166.md): Tobesoft XPlatform Arbitrary File Execution Vulnerability (CVSS 7.8, Tobesoft XPlatform)
- [CVE-2020-6075](https://cve.now/CVE-2020-6075.md): An exploitable out-of-bounds write vulnerability exists in the store\_data\_buffer function of the igcore19d.dll library of Accusoft… (CVSS 9.8, Accusoft)
- [CVE-2020-6076](https://cve.now/CVE-2020-6076.md): An exploitable out-of-bounds write vulnerability exists in the igcore19d.dll ICO icoread parser of the Accusoft ImageGear 19.5.0 library. (CVSS 9.8, Accusoft)
- [CVE-2020-6082](https://cve.now/CVE-2020-6082.md): An exploitable out-of-bounds write vulnerability exists in the ico\_read function of the igcore19d.dll library of Accusoft ImageGear 19.6.0. (CVSS 9.8, Accusoft)
- [CVE-2020-6094](https://cve.now/CVE-2020-6094.md): An exploitable code execution vulnerability exists in the TIFF fillinraster function of the igcore19d.dll library of Accusoft ImageGear… (CVSS 9.8, Accusoft)
- [CVE-2020-4092](https://cve.now/CVE-2020-4092.md): "If port encryption is not enabled on the Domino Server, HCL Nomad on Android and iOS Platforms will communicate in clear text and does… (no CVSS, "HCL Nomad")
- [CVE-2020-12672](https://cve.now/CVE-2020-12672.md): GraphicsMagick through 1.3.35 has a heap-based buffer overflow in ReadMNGImage in coders/png.c. (no CVSS)
- [CVE-2020-10704](https://cve.now/CVE-2020-10704.md): A flaw was found when using samba as an Active Directory Domain Controller. (CVSS 7.5, Red Hat samba)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/archive/2020-05-06
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.