# CVEs published 2020-05-07

77 CVEs were published on May 7, 2020: 5 critical, 10 high. 3 are now in CISA KEV. Days are UTC.

- [CVE-2020-12720](https://cve.now/CVE-2020-12720.md): vBulletin before 5.5.6pl1, 5.6.0 before 5.6.0pl1, and 5.6.1 before 5.6.1pl1 has incorrect access control. (no CVSS)
- [CVE-2020-12719](https://cve.now/CVE-2020-12719.md): XXE during an EventPublisher update can occur in Management Console in WSO2 API Manager 3.0.0 and earlier, API Manager Analytics 2.5.0 and e (CVSS 8.7)
- [CVE-2020-12718](https://cve.now/CVE-2020-12718.md): In administration/comments.php in PHP-Fusion 9.03.50, an authenticated attacker can take advantage of a stored XSS vulnerability in the Prev (no CVSS)
- [CVE-2014-1423](https://cve.now/CVE-2014-1423.md): Online Accounts Signon daemon gives out all oauth tokens to any app (CVSS 5.9, Ubuntu signon)
- [CVE-2020-10916](https://cve.now/CVE-2020-10916.md): This vulnerability allows network-adjacent attackers to escalate privileges on affected installations of TP-Link TL-WA855RE Firmware Ver: 85 (CVSS 8.0, TP-Link TL-WA855RE)
- [CVE-2015-7946](https://cve.now/CVE-2015-7946.md): MTP service exposed during emergency dialer (CVSS 7.3, Canonical unity8)
- [CVE-2020-11056](https://cve.now/CVE-2020-11056.md): Potential Code Injection in Sprout Forms (CVSS 7.4, barrelstrength Sprout Forms · barrelstrength/sprout-base… +1)
- [CVE-2020-11055](https://cve.now/CVE-2020-11055.md): Cross-site Scripting in BookStack (CVSS 6.3, BookStackApp BookStack · ssddanbrown/bookstack)
- [CVE-2020-10176](https://cve.now/CVE-2020-10176.md): ASSA ABLOY Yale WIPC-301W 2.x.2.29 through 2.x.2.43\_p1 devices allow Eval Injection of commands. (no CVSS)
- [CVE-2020-11054](https://cve.now/CVE-2020-11054.md): Incorrect Provision of Specified Functionality in qutebrowser (CVSS 3.5, qutebrowser)
- [CVE-2020-10795](https://cve.now/CVE-2020-10795.md): Gira TKS-IP-Gateway 4.0.7.7 is vulnerable to authenticated remote code execution via the backup functionality of the web frontend. (no CVSS)
- [CVE-2020-10794](https://cve.now/CVE-2020-10794.md): Gira TKS-IP-Gateway 4.0.7.7 is vulnerable to unauthenticated path traversal that allows an attacker to download the application database. (no CVSS)
- [CVE-2020-11053](https://cve.now/CVE-2020-11053.md): Open Redirect in OAuth2 Proxy (CVSS 7.1, OAuth2 Proxy · github.com/oauth2-proxy/oauth2-proxy)
- [CVE-2020-9475](https://cve.now/CVE-2020-9475.md): The S. (no CVSS)
- [CVE-2020-11052](https://cve.now/CVE-2020-11052.md): Improper Restriction of Excessive Authentication Attempts in Sorcery (CVSS 8.3, Sorcery)
- [CVE-2020-9474](https://cve.now/CVE-2020-9474.md): The S. (no CVSS)
- [CVE-2020-11050](https://cve.now/CVE-2020-11050.md): Improper Validation of Certificate with Host Mismatch in Java-WebSocket (CVSS 9.0, TooTallNate Java-WebSocket · org.java-websocket:Java-WebSoc…)
- [CVE-2020-4430](https://cve.now/CVE-2020-4430.md): IBM Data Risk Manager 2.0.1, 2.0.2, 2.0.3, and 2.0.4 could allow a remote authenticated attacker to traverse directories on the system. (CVSS 4.3, KEV, IBM Data Risk Manager)
- [CVE-2020-4429](https://cve.now/CVE-2020-4429.md): IBM Data Risk Manager 2.0.1, 2.0.2, 2.0.3, 2.0.4, 2.0.5, and 2.0.6 contains a default password for an IDRM administrative account. (CVSS 10.0, IBM Data Risk Manager)
- [CVE-2020-4428](https://cve.now/CVE-2020-4428.md): IBM Data Risk Manager 2.0.1, 2.0.2, 2.0.3, and 2.0.4 could allow a remote authenticated attacker to execute arbitrary commands on the system (CVSS 9.1, KEV, IBM Data Risk Manager)
- [CVE-2020-4427](https://cve.now/CVE-2020-4427.md): IBM Data Risk Manager 2.0.1, 2.0.2, 2.0.3, 2.0.4, 2.0.5, and 2.0.6 could allow a remote attacker to bypass security restrictions when config (CVSS 9.0, KEV, IBM Data Risk Manager)
- [CVE-2020-12116](https://cve.now/CVE-2020-12116.md): Zoho ManageEngine OpManager Stable build before 124196 and Released build before 125125 allows an unauthenticated attacker to read arbitrary (no CVSS)
- [CVE-2020-12703](https://cve.now/CVE-2020-12703.md): UliCMS before 2020.2 has XSS during PackageController uninstall. (no CVSS)
- [CVE-2020-12704](https://cve.now/CVE-2020-12704.md): UliCMS before 2020.2 has PageController stored XSS. (no CVSS)
- [CVE-2020-12705](https://cve.now/CVE-2020-12705.md): Multiple cross-site scripting (XSS) vulnerabilities exist in LeptonCMS before 4.6.0. (no CVSS)
- [CVE-2020-12706](https://cve.now/CVE-2020-12706.md): Multiple Cross-site scripting vulnerabilities in PHP-Fusion 9.03.50 allow remote attackers to inject arbitrary web script or HTML via the go (no CVSS)
- [CVE-2020-12707](https://cve.now/CVE-2020-12707.md): An XSS vulnerability exists in modules/wysiwyg/save.php of LeptonCMS 4.5.0. (no CVSS)
- [CVE-2020-12708](https://cve.now/CVE-2020-12708.md): Multiple cross-site scripting vulnerabilities in PHP-Fusion 9.03.50 allow remote attackers to inject arbitrary web script or HTML via the ca (no CVSS)
- [CVE-2019-19164](https://cve.now/CVE-2019-19164.md): Dext5 Upload ActiveX Arbitrary File Execution Vulnerability (CVSS 7.8, RAONWiz dext.ocx ActiveX Control in Dext5 Upload)
- [CVE-2020-10971](https://cve.now/CVE-2020-10971.md): An issue was discovered on Wavlink Jetstream devices where a crafted POST request can be sent to adm.cgi that will result in the execution o (no CVSS)
- [CVE-2020-10972](https://cve.now/CVE-2020-10972.md): An issue was discovered where a page is exposed that has the current administrator password in cleartext in the source code of the page. (no CVSS)
- [CVE-2020-10973](https://cve.now/CVE-2020-10973.md): An issue was discovered in Wavlink WN530HG4, Wavlink WN531G3, Wavlink WN533A8, and Wavlink WN551K1 affecting /cgi-bin/ExportAllSettings.sh w (no CVSS)
- [CVE-2020-7803](https://cve.now/CVE-2020-7803.md): Zoneplayer ActiveX File Download Vulnerability (CVSS 7.8, IMGTech Co Zoneplayer)
- [CVE-2020-10974](https://cve.now/CVE-2020-10974.md): An issue was discovered affecting a backup feature where a crafted POST request returns the current configuration of the device in cleartext (no CVSS)
- [CVE-2020-7805](https://cve.now/CVE-2020-7805.md): An issue was discovered on KT Slim egg IML500 (R7283, R8112, R8424) and IML520 (R8112, R8368, R8411) wifi device. (no CVSS, Infomark KT Slim egg IML500 · Infomark KT Slim egg IML520)
- [CVE-2020-12679](https://cve.now/CVE-2020-12679.md): A reflected cross-site scripting (XSS) vulnerability in the Mitel ShoreTel Conference Web Application 19.50.1000.0 before MiVoice Connect 18 (no CVSS)
- [CVE-2020-7646](https://cve.now/CVE-2020-7646.md): curlrequest through 1.0.1 allows reading any file by populating the file parameter with user input. (no CVSS, curlrequest)
- [CVE-2020-12608](https://cve.now/CVE-2020-12608.md): An issue was discovered in SolarWinds MSP PME (Patch Management Engine) Cache Service before 1.1.15 in the Advanced Monitoring Agent. (no CVSS)
- [CVE-2020-12448](https://cve.now/CVE-2020-12448.md): GitLab EE 12.8 and later allows Exposure of Sensitive Information to an Unauthorized Actor via NuGet. (no CVSS)
- [CVE-2020-5750](https://cve.now/CVE-2020-5750.md): Insufficient output sanitization in TCExam 14.2.2 allows a remote, unauthenticated attacker to conduct persistent cross-site scripting (XSS) (no CVSS, TCExam)
- [CVE-2020-5749](https://cve.now/CVE-2020-5749.md): Insufficient output sanitization in TCExam 14.2.2 allows a remote, authenticated attacker to conduct persistent cross-site scripting (XSS) a (no CVSS, TCExam)
- [CVE-2020-5751](https://cve.now/CVE-2020-5751.md): Insufficient output sanitization in TCExam 14.2.2 allows a remote, authenticated attacker to conduct persistent cross-site scripting (XSS) a (no CVSS, TCExam)
- [CVE-2020-5748](https://cve.now/CVE-2020-5748.md): Insufficient output sanitization in TCExam 14.2.2 allows a remote, unauthenticated attacker to conduct persistent cross-site scripting (XSS) (no CVSS, TCExam)
- [CVE-2020-5745](https://cve.now/CVE-2020-5745.md): Cross-site request forgery in TCExam 14.2.2 allows a remote attacker to perform sensitive application actions by tricking legitimate users i (no CVSS, TCExam)
- [CVE-2020-11431](https://cve.now/CVE-2020-11431.md): The documentation component in i-net Clear Reports 16.0 to 19.2, HelpDesk 8.0 to 8.3, and PDFC 4.3 to 6.2 allows a remote unauthenticated at (no CVSS)
- [CVE-2020-5746](https://cve.now/CVE-2020-5746.md): Insufficient output sanitization in TCExam 14.2.2 allows a remote, authenticated attacker to conduct persistent cross-site scripting (XSS) a (no CVSS, TCExam)
- [CVE-2020-5743](https://cve.now/CVE-2020-5743.md): Improper Control of Resource Identifiers in TCExam 14.2.2 allows a remote, authenticated attacker to access test metadata for which they don (no CVSS, TCExam)
- [CVE-2020-5744](https://cve.now/CVE-2020-5744.md): Relative Path Traversal in TCExam 14.2.2 allows a remote, authenticated attacker to read the contents of arbitrary files on disk. (no CVSS, TCExam)
- [CVE-2020-5747](https://cve.now/CVE-2020-5747.md): Insufficient output sanitization in TCExam 14.2.2 allows a remote, authenticated attacker to conduct persistent cross-site scripting (XSS) a (no CVSS, TCExam)
- [CVE-2020-12683](https://cve.now/CVE-2020-12683.md): Katyshop2 before 2.12 has multiple stored XSS issues. (no CVSS)
- [CVE-2020-6651](https://cve.now/CVE-2020-6651.md): Command injection via specially crafted file name during config file upload (CVSS 8.8, Eaton Intelligent Power manager)
- [CVE-2020-6652](https://cve.now/CVE-2020-6652.md): Incorrect privilege assignment allowing non-admin users to upload config files (CVSS 7.8, Eaton Intelligent Power manager)
- [CVE-2020-12687](https://cve.now/CVE-2020-12687.md): An issue was discovered in Serpico before 1.3.3. (no CVSS)
- [CVE-2020-8983](https://cve.now/CVE-2020-8983.md): An arbitrary file write issue exists in all versions of Citrix ShareFile StorageZones (aka storage zones) Controller, including the most rec (no CVSS)
- [CVE-2020-8982](https://cve.now/CVE-2020-8982.md): An unauthenticated arbitrary file read issue exists in all versions of Citrix ShareFile StorageZones (aka storage zones) Controller, includi (no CVSS)
- [CVE-2020-7473](https://cve.now/CVE-2020-7473.md): In certain situations, all versions of Citrix ShareFile StorageZones (aka storage zones) Controller, including the most recent 5.10.x releas (no CVSS)
- [CVE-2019-18869](https://cve.now/CVE-2019-18869.md): Leftover Debug Code in Blaauw Remote Kiln Control through v3.00r4 allows a user to execute arbitrary php code via /default.php?idx=17. (no CVSS)
- [CVE-2019-18871](https://cve.now/CVE-2019-18871.md): A path traversal in debug.php accessed via default.php in Blaauw Remote Kiln Control through v3.00r4 allows an authenticated attacker to upl (no CVSS)
- [CVE-2019-18870](https://cve.now/CVE-2019-18870.md): A path traversal via the iniFile parameter in excel.php in Blaauw Remote Kiln Control through v3.00r4 allows an authenticated attacker to do (no CVSS)
- [CVE-2019-18872](https://cve.now/CVE-2019-18872.md): Weak password requirements in Blaauw Remote Kiln Control through v3.00r4 allow a user to set short or guessable passwords (e.g., 1 or 1234). (no CVSS)
- [CVE-2019-18866](https://cve.now/CVE-2019-18866.md): Unauthenticated SQL injection via the username in the login mechanism in Blaauw Remote Kiln Control through v3.00r4 allows a user to extract (no CVSS)
- [CVE-2019-18864](https://cve.now/CVE-2019-18864.md): /server-info and /server-status in Blaauw Remote Kiln Control through v3.00r4 allow an unauthenticated attacker to gain sensitive informatio (no CVSS)
- [CVE-2019-18867](https://cve.now/CVE-2019-18867.md): Browsable directories in Blaauw Remote Kiln Control through v3.00r4 allow an attacker to enumerate sensitive filenames and locations, includ (no CVSS)
- [CVE-2019-18868](https://cve.now/CVE-2019-18868.md): Blaauw Remote Kiln Control through v3.00r4 allows an unauthenticated attacker to access MySQL credentials in cleartext in /engine/db.inc, /l (no CVSS)
- [CVE-2019-18865](https://cve.now/CVE-2019-18865.md): Information disclosure via error message discrepancies in authentication functions in Blaauw Remote Kiln Control through v3.00r4 allows an u (no CVSS)
- [CVE-2018-5493](https://cve.now/CVE-2018-5493.md): ATTO FibreBridge 7500N firmware versions prior to 2.90 are susceptible to a vulnerability which allows an unauthenticated remote attacker to (no CVSS, ATTO FibreBridge)
- [CVE-2020-5895](https://cve.now/CVE-2020-5895.md): On NGINX Controller versions 3.1.0-3.3.0, AVRD uses world-readable and world-writable permissions on its socket, which allows processes or u (no CVSS, NGINX Controller)
- [CVE-2020-5894](https://cve.now/CVE-2020-5894.md): On versions 3.0.0-3.3.0, the NGINX Controller webserver does not invalidate the server-side session token after users log out. (no CVSS, NGINX Controller)
- [CVE-2020-6081](https://cve.now/CVE-2020-6081.md): An exploitable code execution vulnerability exists in the PLC\_Task functionality of 3S-Smart Software Solutions GmbH CODESYS Runtime 3.5.14. (CVSS 9.9, 3S)
- [CVE-2020-12696](https://cve.now/CVE-2020-12696.md): The iframe plugin before 4.5 for WordPress does not sanitize a URL. (no CVSS)
- [CVE-2020-11042](https://cve.now/CVE-2020-11042.md): Out-of-bounds Read in FreeRDP (CVSS 5.5, FreeRDP)
- [CVE-2020-11044](https://cve.now/CVE-2020-11044.md): Double Free in FreeRDP (CVSS 2.2, FreeRDP)
- [CVE-2020-11045](https://cve.now/CVE-2020-11045.md): Out-of-bounds Read in FreeRDP (CVSS 2.2, FreeRDP)
- [CVE-2020-11046](https://cve.now/CVE-2020-11046.md): Improper Restriction of Operations within the Bounds of a Memory Buffer in FreeRDP (CVSS 5.5, FreeRDP)
- [CVE-2020-11047](https://cve.now/CVE-2020-11047.md): Out-of-bounds Read in FreeRDP (CVSS 5.5, FreeRDP)
- [CVE-2020-11048](https://cve.now/CVE-2020-11048.md): Out-of-bounds Read in FreeRDPrdp\_read\_flow\_control\_pdu (CVSS 2.2, FreeRDP)
- [CVE-2020-11049](https://cve.now/CVE-2020-11049.md): Out-of-bounds Read in FreeRDPrdp\_read\_share\_control\_header (CVSS 5.5, FreeRDP)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2020-05-07
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.