CVEs published May 5, 2020
39 CVEs were published on May 5, 2020: 0 critical, 4 high.
- Published
- 39
- Critical
- 0
- High
- 4
- Medium
- 9
- Low
- 0
- Unrated
- 26
- Now in CISA KEV
- 0
- Fix available
- 8
Most affected products
- glpi-project GLPI
- 5
- Silver Peak Systems 1. Unity EdgeConnect, NX, VX 2. Unity O…
- 3
- SAE IT-systems FW-50 Remote Telemetry Unit
- 2
- gopkg.in/macaron.v1
- 1
- grin
- 1
- Requarks Wiki.js
- 1
High 4
Medium, low and unrated 35
- CVE-2020-11034bypass of manageRedirect in GLPIglpi-project GLPI
- CVE-2020-12439Grin before 3.1.0 allows attackers to adversely affect availability of data on a Mimblewimble blockchain.grin
- CVE-2020-12463An elevation of privilege vulnerability exists in Avira Software Updater before 2.0.6.27476 due to improperly handling file hard links.
- CVE-2020-11033Able to read any token through API user endpoint in GLPIglpi-project GLPI
- CVE-2019-20768ServiceNow IT Service Management Kingston through Patch 14-1, London through Patch 7, and Madrid before patch 4 allow stored XSS via crafted
- CVE-2020-12666macaron before 1.3.7 has an open redirect in the static handler, as demonstrated by the http://127.0.0.1:4000//example.com/ URL.gopkg.in/macaron.v1
- CVE-2020-11051XSS in Wiki.jsRequarks Wiki.js
- CVE-2020-10859Zoho ManageEngine Desktop Central before 10.0.484 allows authenticated arbitrary file writes during ZIP archive extraction via Directory Tra
- CVE-2020-10634SAE IT-systems FW-50 Remote Telemetry Unit (RTU).SAE IT-systems FW-50 Remote Telemetry Unit
- CVE-2020-10630SAE IT-systems FW-50 Remote Telemetry Unit (RTU).SAE IT-systems FW-50 Remote Telemetry Unit
- CVE-2020-12142IPSec UDP key material can be retrieved from EdgeConnect by a user with admin credentialsSilver Peak Systems 1. Unity EdgeConnect, NX, VX 2. Unity O…
- CVE-2020-12144The certificate used to identify the Silver Peak Cloud Portal to EdgeConnect devices is not validatedSilver Peak Systems 1. Unity EdgeConnect, NX, VX 2. Unity O…
- CVE-2020-12143The certificate used to identify Orchestrator to EdgeConnect devices is not validatedSilver Peak Systems 1. Unity EdgeConnect, NX, VX 2. Unity O…
- CVE-2020-8830CSRF in login.asp on Ruckus devices allows an attacker to access the panel, and use SSRF to perform scraping or other analysis via the SUBCA
- CVE-2020-8829CSRF on Intelbras CIP 92200 devices allows an attacker to access the panel and perform scraping or other analysis.
- CVE-2020-8033Ruckus R500 3.4.2.0.384 devices allow XSS via the index.asp Device Name field.
- CVE-2020-7983A CSRF issue in login.asp on Ruckus R500 3.4.2.0.384 devices allows remote attackers to access the panel or conduct SSRF attacks.
- CVE-2020-5517CSRF in the /login URI in BlueOnyx 5209R allows an attacker to access the dashboard and perform scraping or other analysis.
- CVE-2019-19517Intelbras RF1200 1.1.3 devices allow CSRF to bypass the login.html form, as demonstrated by launching a scrapy process.
- CVE-2019-19515Ayision Ays-WR01 v28K.RPT.20161224 devices allow stored XSS in wireless settings.
- CVE-2019-19514Ayision Ays-WR01 v28K.RPT.20161224 devices allow stored XSS in basic repeater settings via an SSID.
- CVE-2020-8799A Stored XSS vulnerability has been found in the administration page of the WTI Like Post plugin through 1.4.5 for WordPress.
- CVE-2020-12104The Import feature in the wp-advanced-search plugin 3.3.6 for WordPress is vulnerable to authenticated SQL injection via an uploaded .sql fi
- CVE-2020-11737A cross-site scripting (XSS) vulnerability in Web Client in Zimbra 9.0 allows a remote attacker to craft links in an E-Mail message or calen
- CVE-2017-18865Certain NETGEAR devices are affected by a stack-based buffer overflow by an authenticated user.
- CVE-2017-18866Certain NETGEAR devices are affected by stored XSS.
- CVE-2017-18867Certain NETGEAR devices are affected by incorrect configuration of security settings.
- CVE-2020-12659An issue was discovered in the Linux kernel before 5.6.7.
- CVE-2020-12657An issue was discovered in the Linux kernel before 5.6.5.
- CVE-2020-12656gss_mech_free in net/sunrpc/auth_gss/gss_mech_switch.c in the rpcsec_gss_krb5 implementation in the Linux kernel through 5.6.10 lacks certai
- CVE-2020-12655An issue was discovered in xfs_agf_verify in fs/xfs/libxfs/xfs_alloc.c in the Linux kernel through 5.6.10.
- CVE-2020-12654An issue was found in Linux kernel before 5.5.4.
- CVE-2020-12653An issue was found in Linux kernel before 5.5.4.
- CVE-2020-12652The __mptctl_ioctl function in drivers/message/fusion/mptctl.c in the Linux kernel before 5.4.14 allows local users to hold an incorrect loc
- CVE-2020-12649Gurbalib through 2020-04-30 allows lib/cmds/player/help.c directory traversal for reading administrative paths.