CVEs published May 8, 2020
37 CVEs were published on May 8, 2020: 1 critical, 14 high. 1 is now in CISA KEV.
- Published
- 37
- Critical
- 1
- High
- 14
- Medium
- 5
- Low
- 0
- Unrated
- 17
- Now in CISA KEV
- 1
- Fix available
- 16
Most affected products
- Advantech WebAccess Node
- 8
- nvidia graphics drivers
- 2
- [UNKNOWN] keycloak · org.keycloak:keycloak-authz-client
- 1
- [UNKNOWN] keycloak · org.keycloak:keycloak-core
- 1
- Linux kernel kernel
- 1
- McAfee Active Response (MAR) for Linux
- 1
- McAfee Active Response (MAR) for Mac
- 1
- McAfee Active Response (MAR) for Windows
- 1
- McAfee Endpoint Security (ENS) for Mac
- 1
- McAfee Endpoint Security (ENS) for Windows
- 1
Critical 1
High 14
- CVE-2018-20225An issue was discovered in pip (all versions) because it installs the version with the highest version number, even if the user had intended
- CVE-2019-14898The fix for CVE-2019-11599, affecting the Linux kernel before 5.0.10 was not complete.Linux kernel kernel
- CVE-2020-7290Privilege Escalation vulnerability in MAR for LinuxMcAfee Active Response (MAR) for Linux
- CVE-2020-7291Privilege Escalation vulnerability MAR for MacMcAfee Active Response (MAR) for Mac
- CVE-2020-7287Privilege Escalation vulnerability in EDR for LinuxMcAfee Exploit Detection and Response (EDR) for Linux
- CVE-2020-7288Privilege Escalation vulnerability in EDR for MacMcAfee Exploit Detection and Response (EDR) for Mac
- CVE-2020-7289Privilege Escalation vulnerability in MAR for WindowsMcAfee Active Response (MAR) for Windows
- CVE-2020-7285Privilege Escalation vulnerability in MVISION EndpointMcAfee MVISION Endpoint
- CVE-2020-7286Privilege Escalation vulnerability in EDR for WindowsMcAfee Exploit Detection and Response (EDR) for Windows
- CVE-2020-7267Privilege Escalation vulnerability through symbolic links in VSELMcAfee VirusScan Enterprise (VSE) for Linux
- CVE-2020-5741Deserialization of Untrusted Data in Plex Media Server on Windows allows a remote, authenticated attacker to execute arbitrary Python code.Plex Media Server
- CVE-2020-7266Privilege Escalation vulnerability through symbolic links in VSE for WindowsMcAfee VirusScan Enterprise (VSE) for Windows
- CVE-2020-7265Privilege Escalation vulnerability through symbolic links in ENSMMcAfee Endpoint Security (ENS) for Mac
- CVE-2020-7264Privilege Escalation vulnerability through symbolic links in ENS for WindowsMcAfee Endpoint Security (ENS) for Windows
Medium, low and unrated 22
- CVE-2020-11532Zoho ManageEngine DataSecurity Plus prior to 6.0.1 uses default admin credentials to communicate with a DataEngine Xnode server.
- CVE-2020-11531The DataEngine Xnode Server application in Zoho ManageEngine DataSecurity Plus prior to 6.0.1 does not validate the database schema name whe
- CVE-2020-6616Some Broadcom chips mishandle Bluetooth random-number generation because a low-entropy Pseudo Random Number Generator (PRNG) is used in situ
- CVE-2020-11530A blind SQL injection vulnerability is present in Chop Slider 3, a WordPress plugin.
- CVE-2020-12740tcprewrite in Tcpreplay through 4.3.2 has a heap-based buffer over-read during a get_c operation.
- CVE-2020-12737An issue was discovered in Maxum Rumpus before 8.2.12 on macOS.
- CVE-2020-10690There is a use-after-free in kernel versions before 5.5 due to a race condition between the release of ptp_clock and cdev while resource deaRed Hat kernel
- CVE-2019-10170A flaw was found in the Keycloak admin console, where the realm management interface permits a script to be set via the policy.[UNKNOWN] keycloak · org.keycloak:keycloak-core
- CVE-2019-10169A flaw was found in Keycloak’s user-managed access interface, where it would permit a script to be set in the UMA policy.[UNKNOWN] keycloak · org.keycloak:keycloak-authz-client
- CVE-2020-11541In TechSmith SnagIt 11.2.1 through 20.0.3, an XML External Entity (XXE) injection issue exists that would allow a local attacker to exfiltra
- CVE-2020-12680Avira Free Antivirus through 15.0.2005.1866 allows local users to discover user credentials.
- CVE-2020-12018Advantech WebAccess Node, Version 8.4.4 and prior, Version 9.0.0.Advantech WebAccess Node
- CVE-2020-12002Advantech WebAccess Node, Version 8.4.4 and prior, Version 9.0.0.Advantech WebAccess Node
- CVE-2020-10638Advantech WebAccess Node, Version 8.4.4 and prior, Version 9.0.0.Advantech WebAccess Node
- CVE-2020-12026Advantech WebAccess Node, Version 8.4.4 and prior, Version 9.0.0.Advantech WebAccess Node
- CVE-2020-12014Advantech WebAccess Node, Version 8.4.4 and prior, Version 9.0.0.Advantech WebAccess Node
- CVE-2020-12006Advantech WebAccess Node, Version 8.4.4 and prior, Version 9.0.0.Advantech WebAccess Node
- CVE-2020-12010Advantech WebAccess Node, Version 8.4.4 and prior, Version 9.0.0.Advantech WebAccess Node
- CVE-2020-12022Advantech WebAccess Node, Version 8.4.4 and prior, Version 9.0.0.Advantech WebAccess Node
- CVE-2020-12735reset.php in DomainMOD 4.13.0 uses insufficient entropy for password reset requests, leading to account takeover.
- CVE-2012-0953Kernel heap contents leak race in ioctl handlernvidia graphics drivers
- CVE-2012-0952Heap overflow in control device ioctlnvidia graphics drivers