# CVEs published 2020-05-05 39 CVEs were published on May 5, 2020: 0 critical, 4 high. Days are UTC. - [CVE-2020-11036](https://cve.now/CVE-2020-11036.md): XSS in GLPI (CVSS 7.6, glpi-project GLPI) - [CVE-2020-11035](https://cve.now/CVE-2020-11035.md): weak CSRF tokens in GLPI (CVSS 7.5, glpi-project GLPI) - [CVE-2020-11034](https://cve.now/CVE-2020-11034.md): bypass of manageRedirect in GLPI (CVSS 6.1, glpi-project GLPI) - [CVE-2020-12439](https://cve.now/CVE-2020-12439.md): Grin before 3.1.0 allows attackers to adversely affect availability of data on a Mimblewimble blockchain. (no CVSS, grin) - [CVE-2020-12463](https://cve.now/CVE-2020-12463.md): An elevation of privilege vulnerability exists in Avira Software Updater before 2.0.6.27476 due to improperly handling file hard links. (no CVSS) - [CVE-2020-11033](https://cve.now/CVE-2020-11033.md): Able to read any token through API user endpoint in GLPI (CVSS 6.6, glpi-project GLPI) - [CVE-2019-20768](https://cve.now/CVE-2019-20768.md): ServiceNow IT Service Management Kingston through Patch 14-1, London through Patch 7, and Madrid before patch 4 allow stored XSS via crafted (no CVSS) - [CVE-2020-12666](https://cve.now/CVE-2020-12666.md): macaron before 1.3.7 has an open redirect in the static handler, as demonstrated by the http://127.0.0.1:4000//example.com/ URL. (no CVSS, gopkg.in/macaron.v1) - [CVE-2020-11032](https://cve.now/CVE-2020-11032.md): SQL injection on addme\_observer and addme\_assign in GLPI (CVSS 7.6, glpi-project GLPI) - [CVE-2020-11051](https://cve.now/CVE-2020-11051.md): XSS in Wiki.js (CVSS 6.9, Requarks Wiki.js) - [CVE-2020-10859](https://cve.now/CVE-2020-10859.md): Zoho ManageEngine Desktop Central before 10.0.484 allows authenticated arbitrary file writes during ZIP archive extraction via Directory Tra (no CVSS) - [CVE-2020-10634](https://cve.now/CVE-2020-10634.md): SAE IT-systems FW-50 Remote Telemetry Unit (RTU). (no CVSS, SAE IT-systems FW-50 Remote Telemetry Unit) - [CVE-2020-10630](https://cve.now/CVE-2020-10630.md): SAE IT-systems FW-50 Remote Telemetry Unit (RTU). (no CVSS, SAE IT-systems FW-50 Remote Telemetry Unit) - [CVE-2020-12142](https://cve.now/CVE-2020-12142.md): IPSec UDP key material can be retrieved from EdgeConnect by a user with admin credentials (CVSS 4.8, Silver Peak Systems 1. Unity EdgeConnect, NX, VX 2. Unity O…) - [CVE-2020-12144](https://cve.now/CVE-2020-12144.md): The certificate used to identify the Silver Peak Cloud Portal to EdgeConnect devices is not validated (CVSS 6.0, Silver Peak Systems 1. Unity EdgeConnect, NX, VX 2. Unity O…) - [CVE-2020-12143](https://cve.now/CVE-2020-12143.md): The certificate used to identify Orchestrator to EdgeConnect devices is not validated (CVSS 6.0, Silver Peak Systems 1. Unity EdgeConnect, NX, VX 2. Unity O…) - [CVE-2020-8830](https://cve.now/CVE-2020-8830.md): CSRF in login.asp on Ruckus devices allows an attacker to access the panel, and use SSRF to perform scraping or other analysis via the SUBCA (no CVSS) - [CVE-2020-8829](https://cve.now/CVE-2020-8829.md): CSRF on Intelbras CIP 92200 devices allows an attacker to access the panel and perform scraping or other analysis. (no CVSS) - [CVE-2020-8033](https://cve.now/CVE-2020-8033.md): Ruckus R500 3.4.2.0.384 devices allow XSS via the index.asp Device Name field. (no CVSS) - [CVE-2020-7983](https://cve.now/CVE-2020-7983.md): A CSRF issue in login.asp on Ruckus R500 3.4.2.0.384 devices allows remote attackers to access the panel or conduct SSRF attacks. (no CVSS) - [CVE-2020-5517](https://cve.now/CVE-2020-5517.md): CSRF in the /login URI in BlueOnyx 5209R allows an attacker to access the dashboard and perform scraping or other analysis. (no CVSS) - [CVE-2019-19517](https://cve.now/CVE-2019-19517.md): Intelbras RF1200 1.1.3 devices allow CSRF to bypass the login.html form, as demonstrated by launching a scrapy process. (no CVSS) - [CVE-2019-19515](https://cve.now/CVE-2019-19515.md): Ayision Ays-WR01 v28K.RPT.20161224 devices allow stored XSS in wireless settings. (no CVSS) - [CVE-2019-19514](https://cve.now/CVE-2019-19514.md): Ayision Ays-WR01 v28K.RPT.20161224 devices allow stored XSS in basic repeater settings via an SSID. (no CVSS) - [CVE-2020-8799](https://cve.now/CVE-2020-8799.md): A Stored XSS vulnerability has been found in the administration page of the WTI Like Post plugin through 1.4.5 for WordPress. (no CVSS) - [CVE-2020-12104](https://cve.now/CVE-2020-12104.md): The Import feature in the wp-advanced-search plugin 3.3.6 for WordPress is vulnerable to authenticated SQL injection via an uploaded .sql fi (no CVSS) - [CVE-2020-11737](https://cve.now/CVE-2020-11737.md): A cross-site scripting (XSS) vulnerability in Web Client in Zimbra 9.0 allows a remote attacker to craft links in an E-Mail message or calen (no CVSS) - [CVE-2017-18864](https://cve.now/CVE-2017-18864.md): Certain NETGEAR devices are affected by a buffer overflow by an unauthenticated attacker. (CVSS 8.8) - [CVE-2017-18865](https://cve.now/CVE-2017-18865.md): Certain NETGEAR devices are affected by a stack-based buffer overflow by an authenticated user. (CVSS 6.8) - [CVE-2017-18866](https://cve.now/CVE-2017-18866.md): Certain NETGEAR devices are affected by stored XSS. (CVSS 5.2) - [CVE-2017-18867](https://cve.now/CVE-2017-18867.md): Certain NETGEAR devices are affected by incorrect configuration of security settings. (CVSS 6.8) - [CVE-2020-12659](https://cve.now/CVE-2020-12659.md): An issue was discovered in the Linux kernel before 5.6.7. (no CVSS) - [CVE-2020-12657](https://cve.now/CVE-2020-12657.md): An issue was discovered in the Linux kernel before 5.6.5. (no CVSS) - [CVE-2020-12656](https://cve.now/CVE-2020-12656.md): gss\_mech\_free in net/sunrpc/auth\_gss/gss\_mech\_switch.c in the rpcsec\_gss\_krb5 implementation in the Linux kernel through 5.6.10 lacks certai (no CVSS) - [CVE-2020-12655](https://cve.now/CVE-2020-12655.md): An issue was discovered in xfs\_agf\_verify in fs/xfs/libxfs/xfs\_alloc.c in the Linux kernel through 5.6.10. (no CVSS) - [CVE-2020-12654](https://cve.now/CVE-2020-12654.md): An issue was found in Linux kernel before 5.5.4. (no CVSS) - [CVE-2020-12653](https://cve.now/CVE-2020-12653.md): An issue was found in Linux kernel before 5.5.4. (no CVSS) - [CVE-2020-12652](https://cve.now/CVE-2020-12652.md): The \_\_mptctl\_ioctl function in drivers/message/fusion/mptctl.c in the Linux kernel before 5.4.14 allows local users to hold an incorrect loc (no CVSS) - [CVE-2020-12649](https://cve.now/CVE-2020-12649.md): Gurbalib through 2020-04-30 allows lib/cmds/player/help.c directory traversal for reading administrative paths. (no CVSS) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2020-05-05 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.