# CVEs published 2020-05-04

48 CVEs were published on May 4, 2020: 1 critical, 7 high. 2 are now in CISA KEV. Days are UTC.

- [CVE-2020-10686](https://cve.now/CVE-2020-10686.md): A flaw was found in Keycloak version 8.0.2 and 9.0.0, and was fixed in Keycloak version 9.0.1, where a malicious user registers as oneself. (CVSS 4.1, keycloak · org.keycloak:keycloak-core)
- [CVE-2020-10700](https://cve.now/CVE-2020-10700.md): A use-after-free flaw was found in the way samba AD DC LDAP servers, handled 'Paged Results' control is combined with the 'ASQ' control. (CVSS 5.3, Red Hat samba)
- [CVE-2020-5343](https://cve.now/CVE-2020-5343.md): Dell Client platforms restored using a Dell OS recovery image downloaded before December 20, 2019, may contain an insecure inherited permiss (CVSS 7.3, Dell CPG SW)
- [CVE-2020-5337](https://cve.now/CVE-2020-5337.md): RSA Archer, versions prior to 6.7 P1 (6.7.0.1), contain a URL redirection vulnerability. (CVSS 4.6, Dell RSA Archer)
- [CVE-2020-5336](https://cve.now/CVE-2020-5336.md): RSA Archer, versions prior to 6.7 P1 (6.7.0.1), contain a URL injection vulnerability. (CVSS 4.6, Dell RSA Archer)
- [CVE-2020-5335](https://cve.now/CVE-2020-5335.md): RSA Archer, versions prior to 6.7 P2 (6.7.0.2), contain a cross-site request forgery vulnerability. (CVSS 5.0, Dell RSA Archer)
- [CVE-2020-5334](https://cve.now/CVE-2020-5334.md): RSA Archer, versions prior to 6.7 P2 (6.7.0.2), contains a Document Object Model (DOM) based cross-site scripting vulnerability. (CVSS 8.2, Dell RSA Archer)
- [CVE-2020-5333](https://cve.now/CVE-2020-5333.md): RSA Archer, versions prior to 6.7 P3 (6.7.0.3), contain an authorization bypass vulnerability in the REST API. (CVSS 4.3, Dell RSA Archer)
- [CVE-2020-5332](https://cve.now/CVE-2020-5332.md): RSA Archer, versions prior to 6.7 P3 (6.7.0.3), contain a command injection vulnerability. (CVSS 7.2, Dell RSA Archer)
- [CVE-2020-5331](https://cve.now/CVE-2020-5331.md): RSA Archer, versions prior to 6.7 P3 (6.7.0.3), contain an information exposure vulnerability. (CVSS 8.8, Dell RSA Archer)
- [CVE-2020-10622](https://cve.now/CVE-2020-10622.md): LCDS LAquis SCADA Versions 4.3.1 and prior. (no CVSS, LCDS LAquis SCADA Versions 4.3.1 and prior)
- [CVE-2020-10618](https://cve.now/CVE-2020-10618.md): LCDS LAquis SCADA Versions 4.3.1 and prior. (no CVSS, LCDS LAquis SCADA Versions 4.3.1 and prior)
- [CVE-2020-1732](https://cve.now/CVE-2020-1732.md): A flaw was found in Soteria before 1.0.1, in a way that multiple requests occurring concurrently causing security identity corruption across (CVSS 4.2, Red Hat Soteria)
- [CVE-2020-12642](https://cve.now/CVE-2020-12642.md): An issue was discovered in service-api before 4.3.12 and 5.x before 5.1.1 for Report Portal. (no CVSS, com.epam.reportportal:service-api)
- [CVE-2020-12109](https://cve.now/CVE-2020-12109.md): Certain TP-Link devices allow Command Injection. (no CVSS)
- [CVE-2020-12640](https://cve.now/CVE-2020-12640.md): Roundcube Webmail before 1.4.4 allows attackers to include local files and execute code via directory traversal in a plugin name to rcube\_pl (no CVSS)
- [CVE-2020-12641](https://cve.now/CVE-2020-12641.md): rcube\_image.php in Roundcube Webmail before 1.4.4 allows attackers to execute arbitrary code via shell metacharacters in a configuration set (CVSS 9.8, KEV)
- [CVE-2020-10933](https://cve.now/CVE-2020-10933.md): An issue was discovered in Ruby 2.5.x through 2.5.7, 2.6.x through 2.6.5, and 2.7.0. (no CVSS)
- [CVE-2018-21233](https://cve.now/CVE-2018-21233.md): TensorFlow before 1.7.0 has an integer overflow that causes an out-of-bounds read, possibly causing disclosure of the contents of process me (no CVSS, tensorflow-gpu · tensorflow +1)
- [CVE-2020-12111](https://cve.now/CVE-2020-12111.md): Certain TP-Link devices allow Command Injection. (no CVSS)
- [CVE-2020-12110](https://cve.now/CVE-2020-12110.md): Certain TP-Link devices have a Hardcoded Encryption Key. (no CVSS)
- [CVE-2020-11462](https://cve.now/CVE-2020-11462.md): An issue was discovered in OpenVPN Access Server before 2.7.0 and 2.8.x before 2.8.3. (no CVSS)
- [CVE-2020-11443](https://cve.now/CVE-2020-11443.md): The Zoom IT installer for Windows (ZoomInstallerFull.msi) prior to version 4.6.10 deletes files located in %APPDATA%\\Zoom before installing (no CVSS)
- [CVE-2020-12639](https://cve.now/CVE-2020-12639.md): phpList before 3.5.3 allows XSS, with resultant privilege elevation, via lists/admin/template.php. (no CVSS)
- [CVE-2019-13285](https://cve.now/CVE-2019-13285.md): CoSoSys Endpoint Protector 5.1.0.2 allows Host Header Injection. (no CVSS)
- [CVE-2020-12475](https://cve.now/CVE-2020-12475.md): TP-Link Omada Controller Software 3.2.6 allows Directory Traversal for reading arbitrary files via com.tp\_link.eap.web.portal.PortalControll (no CVSS)
- [CVE-2020-8792](https://cve.now/CVE-2020-8792.md): The OKLOK (3.1.1) mobile companion app for Fingerprint Bluetooth Padlock FB50 (2.3) has an information-exposure issue. (no CVSS)
- [CVE-2019-12864](https://cve.now/CVE-2019-12864.md): SolarWinds Orion Platform 2018.4 HF3 (NPM 12.4, NetPath 1.1.4) is vulnerable to Information Leakage, because of improper error handling with (no CVSS)
- [CVE-2020-4209](https://cve.now/CVE-2020-4209.md): IBM Spectrum Protect Plus 10.1.0 through 10.1.5 could allow a remote attacker to traverse directories on the system. (CVSS 5.4, IBM Spectrum Protect Plus)
- [CVE-2020-11671](https://cve.now/CVE-2020-11671.md): Lack of authorization controls in REST API functions in TeamPass through 2.1.27.36 allows any TeamPass user with a valid API token to become (no CVSS, nilsteampassnet/teampass)
- [CVE-2020-8896](https://cve.now/CVE-2020-8896.md): Buffer Overflow in Google Earth Pro (CVSS 4.2, Google Earth Pro)
- [CVE-2020-8791](https://cve.now/CVE-2020-8791.md): The OKLOK (3.1.1) mobile companion app for Fingerprint Bluetooth Padlock FB50 (2.3) allows remote attackers to submit API requests using aut (no CVSS)
- [CVE-2020-10187](https://cve.now/CVE-2020-10187.md): Doorkeeper version 5.0.0 and later contains an information disclosure vulnerability that allows an attacker to retrieve the client secret on (no CVSS, doorkeeper)
- [CVE-2020-8790](https://cve.now/CVE-2020-8790.md): The OKLOK (3.1.1) mobile companion app for Fingerprint Bluetooth Padlock FB50 (2.3) has weak password requirements combined with improper re (no CVSS)
- [CVE-2020-10876](https://cve.now/CVE-2020-10876.md): The OKLOK (3.1.1) mobile companion app for Fingerprint Bluetooth Padlock FB50 (2.3) does not correctly implement its timeout on the four-dig (no CVSS)
- [CVE-2020-11842](https://cve.now/CVE-2020-11842.md): Information disclosure vulnerability in Micro Focus Verastream Host Integrator (VHI) product, affecting versions earlier than 7.8 Update 1 ( (no CVSS, Verastream Host Integrator)
- [CVE-2020-1961](https://cve.now/CVE-2020-1961.md): Vulnerability to Server-Side Template Injection on Mail templates for Apache Syncope 2.0.X releases prior to 2.0.15, 2.1.X releases prior to (no CVSS, Apache Syncope · org.apache.syncope:syncope-core)
- [CVE-2020-12629](https://cve.now/CVE-2020-12629.md): include/class.sla.php in osTicket before 1.14.2 allows XSS via the SLA Name. (no CVSS)
- [CVE-2019-17557](https://cve.now/CVE-2019-17557.md): It was found that the Apache Syncope EndUser UI login page prio to 2.0.15 and 2.1.6 reflects the successMessage parameters. (no CVSS, Apache Syncope · org.apache.syncope.client:syncope-client-e…)
- [CVE-2020-1959](https://cve.now/CVE-2020-1959.md): A Server-Side Template Injection was identified in Apache Syncope prior to 2.1.6 enabling attackers to inject arbitrary Java EL expressions, (no CVSS, Apache Syncope · org.apache.syncope:syncope-core)
- [CVE-2020-12114](https://cve.now/CVE-2020-12114.md): A pivot\_root race condition in fs/namespace.c in the Linux kernel 4.4.x before 4.4.221, 4.9.x before 4.9.221, 4.14.x before 4.14.178, 4.19.x (no CVSS)
- [CVE-2020-8018](https://cve.now/CVE-2020-8018.md): User owned /etc in SLES15-SP1-CHOST-BYOS (CVSS 8.4, SUSE Linux Enterprise Server 15 SP1)
- [CVE-2019-11823](https://cve.now/CVE-2019-11823.md): CRLF injection vulnerability in Network Center in Synology Router Manager (SRM) before 1.2.3-8017-2 allows remote attackers to cause a denia (CVSS 8.6, Synology Router Manager)
- [CVE-2020-1631](https://cve.now/CVE-2020-1631.md): Out of Cycle Security Advisory: Junos OS: Security vulnerability in J-Web and web based (HTTP/HTTPS) services (CVSS 8.8, KEV, Juniper Networks Junos OS)
- [CVE-2020-12627](https://cve.now/CVE-2020-12627.md): Calibre-Web 0.6.6 allows authentication bypass because of the 'A0Zr98j/3yX R~XHH!jmN\]LWX/,?RT' hardcoded secret key. (no CVSS)
- [CVE-2020-12625](https://cve.now/CVE-2020-12625.md): An issue was discovered in Roundcube Webmail before 1.4.4. (no CVSS)
- [CVE-2020-12626](https://cve.now/CVE-2020-12626.md): An issue was discovered in Roundcube Webmail before 1.4.4. (no CVSS)
- [CVE-2020-10717](https://cve.now/CVE-2020-10717.md): A potential DoS flaw was found in the virtio-fs shared file system daemon (virtiofsd) implementation of the QEMU version \>= v5.0. (CVSS 3.3, The QEMU Project QEMU)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2020-05-04
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.