CVEs published May 4, 2020
48 CVEs were published on May 4, 2020: 1 critical, 7 high. 2 are now in CISA KEV.
- Published
- 48
- Critical
- 1
- High
- 7
- Medium
- 9
- Low
- 1
- Unrated
- 30
- Now in CISA KEV
- 2
- Fix available
- 16
Most affected products
- Dell RSA Archer
- 7
- Apache Syncope · org.apache.syncope:syncope-core
- 2
- LCDS LAquis SCADA Versions 4.3.1 and prior
- 2
- Apache Syncope · org.apache.syncope.client:syncope-client-e…
- 1
- com.epam.reportportal:service-api
- 1
- Dell CPG SW
- 1
- doorkeeper
- 1
- Google Earth Pro
- 1
- IBM Spectrum Protect Plus
- 1
- Juniper Networks Junos OS
- 1
Critical 1
High 7
- CVE-2020-5343Dell Client platforms restored using a Dell OS recovery image downloaded before December 20, 2019, may contain an insecure inherited permissDell CPG SW
- CVE-2020-5334RSA Archer, versions prior to 6.7 P2 (6.7.0.2), contains a Document Object Model (DOM) based cross-site scripting vulnerability.Dell RSA Archer
- CVE-2020-5332RSA Archer, versions prior to 6.7 P3 (6.7.0.3), contain a command injection vulnerability.Dell RSA Archer
- CVE-2020-5331RSA Archer, versions prior to 6.7 P3 (6.7.0.3), contain an information exposure vulnerability.Dell RSA Archer
- CVE-2020-8018User owned /etc in SLES15-SP1-CHOST-BYOSSUSE Linux Enterprise Server 15 SP1
- CVE-2019-11823CRLF injection vulnerability in Network Center in Synology Router Manager (SRM) before 1.2.3-8017-2 allows remote attackers to cause a deniaSynology Router Manager
- CVE-2020-1631Out of Cycle Security Advisory: Junos OS: Security vulnerability in J-Web and web based (HTTP/HTTPS) servicesJuniper Networks Junos OS
Medium, low and unrated 40
- CVE-2020-10686A flaw was found in Keycloak version 8.0.2 and 9.0.0, and was fixed in Keycloak version 9.0.1, where a malicious user registers as oneself.keycloak · org.keycloak:keycloak-core
- CVE-2020-10700A use-after-free flaw was found in the way samba AD DC LDAP servers, handled 'Paged Results' control is combined with the 'ASQ' control.Red Hat samba
- CVE-2020-5337RSA Archer, versions prior to 6.7 P1 (6.7.0.1), contain a URL redirection vulnerability.Dell RSA Archer
- CVE-2020-5336RSA Archer, versions prior to 6.7 P1 (6.7.0.1), contain a URL injection vulnerability.Dell RSA Archer
- CVE-2020-5335RSA Archer, versions prior to 6.7 P2 (6.7.0.2), contain a cross-site request forgery vulnerability.Dell RSA Archer
- CVE-2020-5333RSA Archer, versions prior to 6.7 P3 (6.7.0.3), contain an authorization bypass vulnerability in the REST API.Dell RSA Archer
- CVE-2020-10622LCDS LAquis SCADA Versions 4.3.1 and prior.LCDS LAquis SCADA Versions 4.3.1 and prior
- CVE-2020-10618LCDS LAquis SCADA Versions 4.3.1 and prior.LCDS LAquis SCADA Versions 4.3.1 and prior
- CVE-2020-1732A flaw was found in Soteria before 1.0.1, in a way that multiple requests occurring concurrently causing security identity corruption acrossRed Hat Soteria
- CVE-2020-12642An issue was discovered in service-api before 4.3.12 and 5.x before 5.1.1 for Report Portal.com.epam.reportportal:service-api
- CVE-2020-12109Certain TP-Link devices allow Command Injection.
- CVE-2020-12640Roundcube Webmail before 1.4.4 allows attackers to include local files and execute code via directory traversal in a plugin name to rcube_pl
- CVE-2020-10933An issue was discovered in Ruby 2.5.x through 2.5.7, 2.6.x through 2.6.5, and 2.7.0.
- CVE-2018-21233TensorFlow before 1.7.0 has an integer overflow that causes an out-of-bounds read, possibly causing disclosure of the contents of process metensorflow-gpu · tensorflow +1
- CVE-2020-12111Certain TP-Link devices allow Command Injection.
- CVE-2020-12110Certain TP-Link devices have a Hardcoded Encryption Key.
- CVE-2020-11462An issue was discovered in OpenVPN Access Server before 2.7.0 and 2.8.x before 2.8.3.
- CVE-2020-11443The Zoom IT installer for Windows (ZoomInstallerFull.msi) prior to version 4.6.10 deletes files located in %APPDATA%\Zoom before installing
- CVE-2020-12639phpList before 3.5.3 allows XSS, with resultant privilege elevation, via lists/admin/template.php.
- CVE-2019-13285CoSoSys Endpoint Protector 5.1.0.2 allows Host Header Injection.
- CVE-2020-12475TP-Link Omada Controller Software 3.2.6 allows Directory Traversal for reading arbitrary files via com.tp_link.eap.web.portal.PortalControll
- CVE-2020-8792The OKLOK (3.1.1) mobile companion app for Fingerprint Bluetooth Padlock FB50 (2.3) has an information-exposure issue.
- CVE-2019-12864SolarWinds Orion Platform 2018.4 HF3 (NPM 12.4, NetPath 1.1.4) is vulnerable to Information Leakage, because of improper error handling with
- CVE-2020-4209IBM Spectrum Protect Plus 10.1.0 through 10.1.5 could allow a remote attacker to traverse directories on the system.IBM Spectrum Protect Plus
- CVE-2020-11671Lack of authorization controls in REST API functions in TeamPass through 2.1.27.36 allows any TeamPass user with a valid API token to becomenilsteampassnet/teampass
- CVE-2020-8896Buffer Overflow in Google Earth ProGoogle Earth Pro
- CVE-2020-8791The OKLOK (3.1.1) mobile companion app for Fingerprint Bluetooth Padlock FB50 (2.3) allows remote attackers to submit API requests using aut
- CVE-2020-10187Doorkeeper version 5.0.0 and later contains an information disclosure vulnerability that allows an attacker to retrieve the client secret ondoorkeeper
- CVE-2020-8790The OKLOK (3.1.1) mobile companion app for Fingerprint Bluetooth Padlock FB50 (2.3) has weak password requirements combined with improper re
- CVE-2020-10876The OKLOK (3.1.1) mobile companion app for Fingerprint Bluetooth Padlock FB50 (2.3) does not correctly implement its timeout on the four-dig
- CVE-2020-11842Information disclosure vulnerability in Micro Focus Verastream Host Integrator (VHI) product, affecting versions earlier than 7.8 Update 1 (Verastream Host Integrator
- CVE-2020-1961Vulnerability to Server-Side Template Injection on Mail templates for Apache Syncope 2.0.X releases prior to 2.0.15, 2.1.X releases prior toApache Syncope · org.apache.syncope:syncope-core
- CVE-2020-12629include/class.sla.php in osTicket before 1.14.2 allows XSS via the SLA Name.
- CVE-2019-17557It was found that the Apache Syncope EndUser UI login page prio to 2.0.15 and 2.1.6 reflects the successMessage parameters.Apache Syncope · org.apache.syncope.client:syncope-client-e…
- CVE-2020-1959A Server-Side Template Injection was identified in Apache Syncope prior to 2.1.6 enabling attackers to inject arbitrary Java EL expressions,Apache Syncope · org.apache.syncope:syncope-core
- CVE-2020-12114A pivot_root race condition in fs/namespace.c in the Linux kernel 4.4.x before 4.4.221, 4.9.x before 4.9.221, 4.14.x before 4.14.178, 4.19.x
- CVE-2020-12627Calibre-Web 0.6.6 allows authentication bypass because of the 'A0Zr98j/3yX R~XHH!jmN]LWX/,?RT' hardcoded secret key.
- CVE-2020-12625An issue was discovered in Roundcube Webmail before 1.4.4.
- CVE-2020-12626An issue was discovered in Roundcube Webmail before 1.4.4.
- CVE-2020-10717A potential DoS flaw was found in the virtio-fs shared file system daemon (virtiofsd) implementation of the QEMU version >= v5.0.The QEMU Project QEMU