# CVEs published 2020-05-01

5 CVEs were published on May 1, 2020: 0 critical, 1 high. Days are UTC.

- [CVE-2020-10683](https://cve.now/CVE-2020-10683.md): dom4j before 2.0.3 and 2.1.x before 2.1.3 allows external DTDs and External Entities by default, which might enable XXE attacks. (no CVSS, org.dom4j:dom4j · dom4j:dom4j)
- [CVE-2019-4209](https://cve.now/CVE-2019-4209.md): HCL Connections v5.5, v6.0, and v6.5 contains an open redirect vulnerability which could be exploited by an attacker to conduct phishing att (no CVSS, HCL Connections)
- [CVE-2020-7351](https://cve.now/CVE-2020-7351.md): Fonality Trixbox CE Post-Authentication Command Injection (CVSS 7.3, Fonality Trixbox Community Edition)
- [CVE-2020-12474](https://cve.now/CVE-2020-12474.md): Telegram Desktop through 2.0.1, Telegram through 6.0.1 for Android, and Telegram through 6.0.1 for iOS allow an IDN Homograph attack via Pun (no CVSS)
- [CVE-2020-12117](https://cve.now/CVE-2020-12117.md): Moxa Service in Moxa NPort 5150A firmware version 1.5 and earlier allows attackers to obtain sensitive configuration values via a crafted pa (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2020-05-01
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.