# CVEs published 2020-05-12 47 CVEs were published on May 12, 2020: 5 critical, 11 high. Days are UTC. - [CVE-2020-11057](https://cve.now/CVE-2020-11057.md): Code Injection in XWiki Platform (CVSS 9.9, XWiki Platform) - [CVE-2020-1718](https://cve.now/CVE-2020-1718.md): A flaw was found in the reset credential flow in all Keycloak versions before 8.0.0. (CVSS 7.1, Red Hat keycloak · org.keycloak:keycloak-parent) - [CVE-2020-12772](https://cve.now/CVE-2020-12772.md): An issue was discovered in Ignite Realtime Spark 2.8.3 (and the ROAR plugin for it) on Windows. (no CVSS) - [CVE-2020-11060](https://cve.now/CVE-2020-11060.md): Remote Code Execution in GLPI (CVSS 7.4, glpi-project GLPI) - [CVE-2020-11062](https://cve.now/CVE-2020-11062.md): Reflexive XSS in GLPI (CVSS 6.0, GLPI) - [CVE-2020-12826](https://cve.now/CVE-2020-12826.md): A signal access-control issue was discovered in the Linux kernel before 5.6.5, aka CID-7395ea4e65c2. (no CVSS) - [CVE-2020-6242](https://cve.now/CVE-2020-6242.md): SAP Business Objects Business Intelligence Platform (Live Data Connect), versions 1.0, 2.0, 2.1, 2.2, 2.3, allows an attacker to logon on… (CVSS 9.8, SAP SE SAP Business Objects Business Intelligence Platform) - [CVE-2020-6258](https://cve.now/CVE-2020-6258.md): SAP Identity Management, version 8.0, does not perform necessary authorization checks for an authenticated user, allowing the attacker to… (CVSS 4.3, SAP SE SAP Identity Management) - [CVE-2020-6254](https://cve.now/CVE-2020-6254.md): SAP Enterprise Threat Detection, versions 1.0, 2.0, does not sufficiently encode error response pages in case of errors, allowing XSS… (CVSS 6.1, SAP SE SAP Enterprise Threat Detection) - [CVE-2020-6241](https://cve.now/CVE-2020-6241.md): SAP Adaptive Server Enterprise, version 16.0, allows an authenticated user to execute crafted database queries to elevate privileges of… (CVSS 8.8, SAP SE SAP Adaptive Server Enterprise) - [CVE-2020-6259](https://cve.now/CVE-2020-6259.md): Under certain conditions SAP Adaptive Server Enterprise, versions 15.7, 16.0, allows an attacker to access information which would… (CVSS 6.5, SAP SE SAP Adaptive Server Enterprise) - [CVE-2020-6252](https://cve.now/CVE-2020-6252.md): Under certain conditions SAP Adaptive Server Enterprise (Cockpit), version 16.0, allows an attacker with access to local network, to get… (CVSS 9.0, SAP SE SAP Adaptive Server Enterprise) - [CVE-2020-6253](https://cve.now/CVE-2020-6253.md): Under certain conditions, SAP Adaptive Server Enterprise (Web Services), versions 15.7, 16.0, allows an authenticated user to execute… (CVSS 7.2, SAP SE SAP Adaptive Server Enterprise) - [CVE-2020-6244](https://cve.now/CVE-2020-6244.md): SAP Business Client, version 7.0, allows an attacker after a successful social engineering attack to inject malicious code as a DLL file… (CVSS 7.0, SAP SE SAP Business Client) - [CVE-2020-6257](https://cve.now/CVE-2020-6257.md): SAP Business Objects Business Intelligence Platform (CMC and BI Launchpad) 4.2 does not sufficiently encode user-controlled inputs… (CVSS 5.4, SAP SE SAP Business Objects Business Intelligence Platform) - [CVE-2020-6250](https://cve.now/CVE-2020-6250.md): SAP Adaptive Server Enterprise, version 16.0, allows an authenticated attacker to exploit certain misconfigured endpoints exposed over the… (CVSS 6.8, SAP SE SAP Adaptive Server Enterprise) - [CVE-2020-6262](https://cve.now/CVE-2020-6262.md): Service Data Download in SAP Application Server ABAP (ST-PI, before versions 2008\_1\_46C, 2008\_1\_620, 2008\_1\_640, 2008\_1\_700, 2008\_1\_710… (CVSS 9.9, SAP SE SAP Application Server ABAP) - [CVE-2020-6256](https://cve.now/CVE-2020-6256.md): SAP Master Data Governance, versions - 748, 749, 750, 751, 752, 800, 801, 802, 803, 804, allows users to display change request details… (CVSS 5.4, SAP SE SAP Master Data Governance) - [CVE-2020-6248](https://cve.now/CVE-2020-6248.md): SAP Adaptive Server Enterprise (Backup Server), version 16.0, does not perform the necessary validation checks for an authenticated user… (CVSS 9.1, SAP SE SAP Adaptive Server Enterprise) - [CVE-2020-6251](https://cve.now/CVE-2020-6251.md): Under certain conditions or error scenarios SAP Business Objects Business Intelligence Platform, version 4.2, allows an attacker to access… (CVSS 5.4, SAP SE SAP BusinessObjects Business Intelligence Platform) - [CVE-2020-6247](https://cve.now/CVE-2020-6247.md): SAP Business Objects Business Intelligence Platform, version 4.2, allows an unauthenticated attacker to prevent legitimate users from… (CVSS 5.9, SAP SE SAP Business Objects Business Intelligence Platform) - [CVE-2020-6245](https://cve.now/CVE-2020-6245.md): SAP Business Objects Business Intelligence Platform, version 4.2, allows an attacker with access to local instance, to inject file or code… (CVSS 6.5, SAP SE SAP Business Objects Business Intelligence Platform) - [CVE-2020-6249](https://cve.now/CVE-2020-6249.md): The use of an admin backend report within SAP Master Data Governance, versions - S4CORE 101, S4FND 102, 103, 104, SAP\_BS\_FND 748; allows… (CVSS 7.7, SAP SE SAP Master Data Governance) - [CVE-2020-6243](https://cve.now/CVE-2020-6243.md): Under certain conditions, SAP Adaptive Server Enterprise (XP Server on Windows Platform), versions 15.7, 16.0, does not perform the… (CVSS 8.0, SAP SE SAP Adaptive Server Enterprise) - [CVE-2020-6240](https://cve.now/CVE-2020-6240.md): SAP NetWeaver AS ABAP (Web Dynpro ABAP), versions (SAP\_UI 750, 752, 753, 754 and SAP\_BASIS 700, 710, 730, 731, 804) allows an… (CVSS 5.3, SAP SE SAP NetWeaver AS ABAP (Web Dynpro ABAP)) - [CVE-2020-12825](https://cve.now/CVE-2020-12825.md): libcroco through 0.6.13 has excessive recursion in cr\_parser\_parse\_any\_core in cr-parser.c, leading to stack consumption. (no CVSS) - [CVE-2020-1746](https://cve.now/CVE-2020-1746.md): A flaw was found in the Ansible Engine affecting Ansible Engine versions 2.7.x before 2.7.17 and 2.8.x before 2.8.11 and 2.9.x before… (CVSS 5.0, Red Hat ansible · ansible) - [CVE-2020-12823](https://cve.now/CVE-2020-12823.md): OpenConnect 8.09 has a buffer overflow, causing a denial of service (application crash) or possibly unspecified other impact, via crafted… (no CVSS) - [CVE-2020-5248](https://cve.now/CVE-2020-5248.md): Public GLPIKEY can be used to decrypt any data in GLPI (CVSS 7.2, glpi-project glpi) - [CVE-2020-5898](https://cve.now/CVE-2020-5898.md): In versions 7.1.5-7.1.9, BIG-IP Edge Client Windows Stonewall driver does not sanitize the pointer received from the userland. (no CVSS, F5 Edge Client) - [CVE-2020-5896](https://cve.now/CVE-2020-5896.md): On versions 7.1.5-7.1.9, the BIG-IP Edge Client's Windows Installer Service's temporary folder has weak file and folder permissions. (no CVSS, F5 Edge Client) - [CVE-2020-5897](https://cve.now/CVE-2020-5897.md): In versions 7.1.5-7.1.9, there is use-after-free memory vulnerability in the BIG-IP Edge Client Windows ActiveX component. (no CVSS, F5 Edge Client) - [CVE-2020-1939](https://cve.now/CVE-2020-1939.md): The Apache NuttX (Incubating) project provides an optional separate "apps" repository which contains various optional components and… (no CVSS, Apache NuttX) - [CVE-2020-10706](https://cve.now/CVE-2020-10706.md): A flaw was found in OpenShift Container Platform where OAuth tokens are not encrypted when the encryption of data at rest is enabled. (CVSS 6.3, \[UNKNOWN\] openshift/openshift-apiserver) - [CVE-2020-1763](https://cve.now/CVE-2020-1763.md): An out-of-bounds buffer read flaw was found in the pluto daemon of libreswan from versions 3.27 till 3.31 where, an unauthenticated… (CVSS 7.5, the libreswan Project libreswan) - [CVE-2020-4346](https://cve.now/CVE-2020-4346.md): IBM API Connect's V2018.4.1.0 through 2018.4.1.10 management server has an unsecured api which can be exploited by an unauthenticated… (CVSS 5.3, IBM API Connect) - [CVE-2020-4195](https://cve.now/CVE-2020-4195.md): IBM API Connect V2018.4.1.0 through 2018.4.1.10 could allow a remote attacker to hijack the clicking action of the victim. (CVSS 5.4, IBM API Connect) - [CVE-2019-4478](https://cve.now/CVE-2019-4478.md): IBM Maximo Asset Management 7.6.0, and 7.6.1 could allow an authenticated user to obtain highly sensitive information that they should not… (CVSS 6.5, IBM Maximo Asset Management) - [CVE-2020-8159](https://cve.now/CVE-2020-8159.md): There is a vulnerability in actionpack\_page-caching gem \< v1.2.1 that allows an attacker to write arbitrary files to a web server… (no CVSS, https://github.com/rails/actionpack-page\_caching · actionpa…) - [CVE-2020-8151](https://cve.now/CVE-2020-8151.md): There is a possible information disclosure issue in Active Resource \