# CVEs published 2020-05-06

72 CVEs were published on May 6, 2020: 6 critical, 20 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2020-12689](https://cve.now/CVE-2020-12689.md): An issue was discovered in OpenStack Keystone before 15.0.1, and 16.0.0. (no CVSS, keystone)
- [CVE-2020-12690](https://cve.now/CVE-2020-12690.md): An issue was discovered in OpenStack Keystone before 15.0.1, and 16.0.0. (no CVSS, keystone)
- [CVE-2020-12691](https://cve.now/CVE-2020-12691.md): An issue was discovered in OpenStack Keystone before 15.0.1, and 16.0.0. (no CVSS, keystone)
- [CVE-2020-12692](https://cve.now/CVE-2020-12692.md): An issue was discovered in OpenStack Keystone before 15.0.1, and 16.0.0. (no CVSS, keystone)
- [CVE-2020-12669](https://cve.now/CVE-2020-12669.md): core/get\_menudiv.php in Dolibarr before 11.0.4 allows remote authenticated attackers to bypass intended access restrictions via a non-alphan (no CVSS, dolibarr/dolibarr)
- [CVE-2018-8956](https://cve.now/CVE-2018-8956.md): ntpd in ntp 4.2.8p10, 4.2.8p11, 4.2.8p12 and 4.2.8p13 allow remote attackers to prevent a broadcast client from synchronizing its clock with (no CVSS)
- [CVE-2020-11727](https://cve.now/CVE-2020-11727.md): A cross-site scripting (XSS) vulnerability in the AlgolPlus Advanced Order Export For WooCommerce plugin 3.1.3 for WordPress allows remote a (no CVSS)
- [CVE-2020-3308](https://cve.now/CVE-2020-3308.md): Cisco Firepower Threat Defense Software Signature Verification Bypass Vulnerability (CVSS 4.9, Cisco Firepower Threat Defense Software)
- [CVE-2020-3307](https://cve.now/CVE-2020-3307.md): Cisco Firepower Management Center Arbitrary Log File Write Vulnerability (CVSS 5.3, Cisco Firepower Management Center)
- [CVE-2020-3306](https://cve.now/CVE-2020-3306.md): Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software DHCP Denial of Service Vulnerability (CVSS 6.8, Cisco Adaptive Security Appliance (ASA) Software)
- [CVE-2020-3305](https://cve.now/CVE-2020-3305.md): Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software BGP Denial of Service Vulnerability (CVSS 6.8, Cisco Adaptive Security Appliance (ASA) Software)
- [CVE-2020-3303](https://cve.now/CVE-2020-3303.md): Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software IKEv1 Denial of Service Vulnerability (CVSS 6.8, Cisco Adaptive Security Appliance (ASA) Software)
- [CVE-2020-3302](https://cve.now/CVE-2020-3302.md): Cisco Firepower Management Center File Overwrite Vulnerability (CVSS 6.8, Cisco Firepower Management Center)
- [CVE-2020-3301](https://cve.now/CVE-2020-3301.md): Cisco Firepower Management Center Static Credential Vulnerabilities (CVSS 8.1, Cisco Firepower Management Center)
- [CVE-2020-3298](https://cve.now/CVE-2020-3298.md): Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software Malformed OSPF Packets Processing Denial of Service Vulnerability (CVSS 8.6, Cisco Adaptive Security Appliance (ASA) Software)
- [CVE-2020-3285](https://cve.now/CVE-2020-3285.md): Cisco Firepower Threat Defense Software SSL/TLS URL Category Bypass Vulnerability (CVSS 5.8, Cisco Firepower Threat Defense Software)
- [CVE-2020-3283](https://cve.now/CVE-2020-3283.md): Cisco Firepower 1000 Series SSL/TLS Denial of Service Vulnerability (CVSS 8.6, Cisco Firepower Threat Defense Software)
- [CVE-2020-3259](https://cve.now/CVE-2020-3259.md): Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software Web Services Information Disclosure Vulnerability (CVSS 7.5, KEV, Cisco Adaptive Security Appliance (ASA) Software)
- [CVE-2020-3256](https://cve.now/CVE-2020-3256.md): Cisco Hosted Collaboration Mediation Fulfillment XML External Expansion Vulnerability (CVSS 4.9, Cisco Hosted Collaboration Mediation Fulfillment)
- [CVE-2020-3255](https://cve.now/CVE-2020-3255.md): Cisco Firepower Threat Defense Software Packet Flood Denial of Service Vulnerability (CVSS 7.5, Cisco Firepower Threat Defense Software)
- [CVE-2020-3254](https://cve.now/CVE-2020-3254.md): Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software Media Gateway Control Protocol Denial of Service Vulnerabilities (CVSS 8.6, Cisco Adaptive Security Appliance (ASA) Software)
- [CVE-2020-3253](https://cve.now/CVE-2020-3253.md): Cisco Firepower Threat Defense Software Shell Access Vulnerability (CVSS 6.7, Cisco Firepower Threat Defense Software)
- [CVE-2020-3246](https://cve.now/CVE-2020-3246.md): Cisco Umbrella Carriage Return Line Feed Injection Vulnerability (CVSS 4.7, Cisco Umbrella)
- [CVE-2020-3196](https://cve.now/CVE-2020-3196.md): Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software SSL/TLS Denial of Service Vulnerability (CVSS 8.6, Cisco Adaptive Security Appliance (ASA) Software)
- [CVE-2020-3195](https://cve.now/CVE-2020-3195.md): Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software OSPF Packets Processing Memory Leak Vulnerability (CVSS 8.6, Cisco Adaptive Security Appliance (ASA) Software)
- [CVE-2020-3191](https://cve.now/CVE-2020-3191.md): Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software IPv6 DNS Denial of Service Vulnerability (CVSS 8.6, Cisco Adaptive Security Appliance (ASA) Software)
- [CVE-2020-3189](https://cve.now/CVE-2020-3189.md): Cisco Firepower Threat Defense Software VPN System Logging Denial of Service Vulnerability (CVSS 8.6, Cisco Firepower Threat Defense Software)
- [CVE-2020-3188](https://cve.now/CVE-2020-3188.md): Cisco Firepower Threat Defense Software Management Interface Denial of Service Vulnerability (CVSS 5.3, Cisco Firepower Threat Defense Software)
- [CVE-2020-3187](https://cve.now/CVE-2020-3187.md): Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software Web Services Path Traversal Vulnerability (CVSS 9.1, Cisco Adaptive Security Appliance (ASA) Software)
- [CVE-2020-3334](https://cve.now/CVE-2020-3334.md): Cisco Firepower 2100 Series Security Appliances ARP Denial of Service Vulnerability (CVSS 7.4, Cisco Adaptive Security Appliance (ASA) Software)
- [CVE-2020-3329](https://cve.now/CVE-2020-3329.md): Cisco IMC Supervisor, Cisco UCS Director, and Cisco UCS Director Express for Big Data Role-Based Access Control Vulnerability (CVSS 4.3, Cisco UCS Director)
- [CVE-2020-3318](https://cve.now/CVE-2020-3318.md): Cisco Firepower Management Center Static Credential Vulnerabilities (CVSS 8.1, Cisco Firepower Management Center)
- [CVE-2020-3315](https://cve.now/CVE-2020-3315.md): Multiple Cisco Products Snort HTTP Detection Engine File Policy Bypass Vulnerability (CVSS 5.8, Cisco Firepower Threat Defense Software)
- [CVE-2020-3313](https://cve.now/CVE-2020-3313.md): Cisco Firepower Management Center Cross-Site Scripting Vulnerability (CVSS 6.5, Cisco Firepower Management Center)
- [CVE-2020-3312](https://cve.now/CVE-2020-3312.md): Cisco Firepower Threat Defense Software Information Disclosure Vulnerability (CVSS 5.8, Cisco Firepower Threat Defense Software)
- [CVE-2020-3311](https://cve.now/CVE-2020-3311.md): Cisco Firepower Management Center Open Redirect Vulnerability (CVSS 4.3, Cisco Firepower Management Center)
- [CVE-2020-3310](https://cve.now/CVE-2020-3310.md): Cisco Firepower Device Manager On-Box Software XML Parsing Vulnerability (CVSS 5.5, Cisco Firepower Threat Defense Software)
- [CVE-2020-3309](https://cve.now/CVE-2020-3309.md): Cisco Firepower Device Manager On-Box Software Arbitrary File Overwrite Vulnerability (CVSS 6.5, Cisco Firepower Threat Defense Software)
- [CVE-2020-3125](https://cve.now/CVE-2020-3125.md): Cisco Adaptive Security Appliance Software Kerberos Authentication Bypass Vulnerability (CVSS 8.1, Cisco Adaptive Security Appliance (ASA) Software)
- [CVE-2020-3179](https://cve.now/CVE-2020-3179.md): Cisco Firepower Threat Defense Software Generic Routing Encapsulation Tunnel IPv6 Denial of Service Vulnerability (CVSS 8.6, Cisco Firepower Threat Defense Software)
- [CVE-2020-3178](https://cve.now/CVE-2020-3178.md): Cisco Content Security Management Appliance Open Redirect Vulnerabilities (CVSS 6.1, Cisco Content Security Management Appliance)
- [CVE-2020-3186](https://cve.now/CVE-2020-3186.md): Cisco Firepower Threat Defense Software Management Access List Bypass Vulnerability (CVSS 5.3, Cisco Firepower Threat Defense Software)
- [CVE-2020-8899](https://cve.now/CVE-2020-8899.md): Memory corruption in Quram library when decoding qmg can lead to RCE (CVSS 10.0, Samsung Android OS)
- [CVE-2020-7921](https://cve.now/CVE-2020-7921.md): Administrative action may disable enforcement of per-user IP whitelisting (CVSS 4.6, MongoDB Server)
- [CVE-2020-12108](https://cve.now/CVE-2020-12108.md): /options/mailman in GNU Mailman before 2.1.31 allows Arbitrary Content Injection. (no CVSS)
- [CVE-2020-4446](https://cve.now/CVE-2020-4446.md): IBM Business Process Manager 8.0, 8.5, and 8.6 and IBM Business Automation Workflow 18.0 and 19.0 could allow a remote attacker to bypass se (CVSS 4.3, IBM Business Process Manager Standard · IBM Business Automa…)
- [CVE-2020-4421](https://cve.now/CVE-2020-4421.md): IBM WebSphere Application Liberty 19.0.0.5 through 20.0.0.4 could allow an authenticated user using openidconnect to spoof another users ide (CVSS 5.0, IBM WebSphere Application Server Liberty)
- [CVE-2020-4384](https://cve.now/CVE-2020-4384.md): IBM InfoSphere Information Server 11.3, 11.5, and 11.7 is vulnerable to cross-site scripting. (CVSS 5.4, IBM InfoSphere Information Server)
- [CVE-2019-4266](https://cve.now/CVE-2019-4266.md): IBM Maximo Anywhere 7.6.2.0, 7.6.2.1, 7.6.3.0, and 7.6.3.1 does not have device jailbreak detection which could result in an attacker gainin (CVSS 2.4, IBM Maximo Anywhere)
- [CVE-2020-6861](https://cve.now/CVE-2020-6861.md): A flawed protocol design in the Ledger Monero app before 1.5.1 for Ledger Nano and Ledger S devices allows a local attacker to extract the m (no CVSS)
- [CVE-2020-10693](https://cve.now/CVE-2020-10693.md): A flaw was found in Hibernate Validator version 6.1.2.Final. (CVSS 5.3, hibernate-validator · org.hibernate.validator:hibernate-… +1)
- [CVE-2019-19168](https://cve.now/CVE-2019-19168.md): Dext5.ocx ActiveX 5.0.0.116 and eariler versions contain a vulnerability, which could allow remote attacker to download and execute remote a (CVSS 7.8, RAONwiz Dext.ocx ActiveX Control in Dext5 Upload)
- [CVE-2019-19169](https://cve.now/CVE-2019-19169.md): Dext5.ocx ActiveX 5.0.0.116 and eariler versions contain a vulnerability, which could allow remote attacker to download arbitrary file by se (CVSS 7.8, RAONwiz Dext.ocx ActiveX Control in Dext5 Upload)
- [CVE-2020-7806](https://cve.now/CVE-2020-7806.md): Tobesoft Xplatform ActiveX File Download Vulnerability (CVSS 7.8, Tobesoft Xplatform)
- [CVE-2019-19167](https://cve.now/CVE-2019-19167.md): Tobesoft Nexacro14 ActiveX File Download Vulnerability (CVSS 7.8, Tobesoft Nexacro14)
- [CVE-2020-2189](https://cve.now/CVE-2020-2189.md): Jenkins SCM Filter Jervis Plugin 0.2.1 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types, resul (no CVSS, Jenkins project Jenkins SCM Filter Jervis Plugin · io.jenki…)
- [CVE-2020-2187](https://cve.now/CVE-2020-2187.md): Jenkins Amazon EC2 Plugin 1.50.1 and earlier unconditionally accepts self-signed certificates and does not perform hostname validation, enab (no CVSS, Jenkins project Jenkins Amazon EC2 Plugin · org.jenkins-ci.…)
- [CVE-2020-2188](https://cve.now/CVE-2020-2188.md): A missing permission check in Jenkins Amazon EC2 Plugin 1.50.1 and earlier in form-related methods allowed users with Overall/Read access to (no CVSS, Jenkins project Jenkins Amazon EC2 Plugin · org.jenkins-ci.…)
- [CVE-2020-2185](https://cve.now/CVE-2020-2185.md): Jenkins Amazon EC2 Plugin 1.50.1 and earlier does not validate SSH host keys when connecting agents, enabling man-in-the-middle attacks. (no CVSS, Jenkins project Jenkins Amazon EC2 Plugin · org.jenkins-ci.…)
- [CVE-2020-2186](https://cve.now/CVE-2020-2186.md): A cross-site request forgery vulnerability in Jenkins Amazon EC2 Plugin 1.50.1 and earlier allows attackers to provision instances. (no CVSS, Jenkins project Jenkins Amazon EC2 Plugin · org.jenkins-ci.…)
- [CVE-2020-2182](https://cve.now/CVE-2020-2182.md): Jenkins Credentials Binding Plugin 1.22 and earlier does not mask (i.e., replace with asterisks) secrets containing a \`$\` character in some (no CVSS, Jenkins project Jenkins Credentials Binding Plugin · org.je…)
- [CVE-2020-2183](https://cve.now/CVE-2020-2183.md): Jenkins Copy Artifact Plugin 1.43.1 and earlier performs improper permission checks, allowing attackers to copy artifacts from jobs they hav (no CVSS, Jenkins project Jenkins Copy Artifact Plugin · org.jenkins-…)
- [CVE-2020-2184](https://cve.now/CVE-2020-2184.md): A cross-site request forgery vulnerability in Jenkins CVS Plugin 2.15 and earlier allows attackers to create and manipulate tags, and to con (no CVSS, Jenkins project Jenkins CVS Plugin · org.jenkins-ci.plugins…)
- [CVE-2020-2181](https://cve.now/CVE-2020-2181.md): Jenkins Credentials Binding Plugin 1.22 and earlier does not mask (i.e., replace with asterisks) secrets in the build log when the build con (no CVSS, Jenkins project Jenkins Credentials Binding Plugin · org.je…)
- [CVE-2019-19166](https://cve.now/CVE-2019-19166.md): Tobesoft XPlatform Arbitrary File Execution Vulnerability (CVSS 7.8, Tobesoft XPlatform)
- [CVE-2020-6075](https://cve.now/CVE-2020-6075.md): An exploitable out-of-bounds write vulnerability exists in the store\_data\_buffer function of the igcore19d.dll library of Accusoft ImageGear (CVSS 9.8, Accusoft)
- [CVE-2020-6076](https://cve.now/CVE-2020-6076.md): An exploitable out-of-bounds write vulnerability exists in the igcore19d.dll ICO icoread parser of the Accusoft ImageGear 19.5.0 library. (CVSS 9.8, Accusoft)
- [CVE-2020-6082](https://cve.now/CVE-2020-6082.md): An exploitable out-of-bounds write vulnerability exists in the ico\_read function of the igcore19d.dll library of Accusoft ImageGear 19.6.0. (CVSS 9.8, Accusoft)
- [CVE-2020-6094](https://cve.now/CVE-2020-6094.md): An exploitable code execution vulnerability exists in the TIFF fillinraster function of the igcore19d.dll library of Accusoft ImageGear 19.4 (CVSS 9.8, Accusoft)
- [CVE-2020-4092](https://cve.now/CVE-2020-4092.md): "If port encryption is not enabled on the Domino Server, HCL Nomad on Android and iOS Platforms will communicate in clear text and does not (no CVSS, "HCL Nomad")
- [CVE-2020-12672](https://cve.now/CVE-2020-12672.md): GraphicsMagick through 1.3.35 has a heap-based buffer overflow in ReadMNGImage in coders/png.c. (no CVSS)
- [CVE-2020-10704](https://cve.now/CVE-2020-10704.md): A flaw was found when using samba as an Active Directory Domain Controller. (CVSS 7.5, Red Hat samba)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2020-05-06
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.