# CVEs published 2020-05-08 37 CVEs were published on May 8, 2020: 1 critical, 14 high. 1 is now in CISA KEV. Days are UTC. - [CVE-2020-11532](https://cve.now/CVE-2020-11532.md): Zoho ManageEngine DataSecurity Plus prior to 6.0.1 uses default admin credentials to communicate with a DataEngine Xnode server. (no CVSS) - [CVE-2020-11531](https://cve.now/CVE-2020-11531.md): The DataEngine Xnode Server application in Zoho ManageEngine DataSecurity Plus prior to 6.0.1 does not validate the database schema name whe (no CVSS) - [CVE-2020-6616](https://cve.now/CVE-2020-6616.md): Some Broadcom chips mishandle Bluetooth random-number generation because a low-entropy Pseudo Random Number Generator (PRNG) is used in situ (no CVSS) - [CVE-2020-11530](https://cve.now/CVE-2020-11530.md): A blind SQL injection vulnerability is present in Chop Slider 3, a WordPress plugin. (no CVSS) - [CVE-2020-11006](https://cve.now/CVE-2020-11006.md): Potential remote code execution in Shopizer (CVSS 9.1, shopizer-ecommerce shopizer) - [CVE-2018-20225](https://cve.now/CVE-2018-20225.md): An issue was discovered in pip (all versions) because it installs the version with the highest version number, even if the user had intended (CVSS 7.8) - [CVE-2020-12740](https://cve.now/CVE-2020-12740.md): tcprewrite in Tcpreplay through 4.3.2 has a heap-based buffer over-read during a get\_c operation. (no CVSS) - [CVE-2020-12737](https://cve.now/CVE-2020-12737.md): An issue was discovered in Maxum Rumpus before 8.2.12 on macOS. (no CVSS) - [CVE-2019-14898](https://cve.now/CVE-2019-14898.md): The fix for CVE-2019-11599, affecting the Linux kernel before 5.0.10 was not complete. (CVSS 7.0, Linux kernel kernel) - [CVE-2020-10690](https://cve.now/CVE-2020-10690.md): There is a use-after-free in kernel versions before 5.5 due to a race condition between the release of ptp\_clock and cdev while resource dea (CVSS 6.5, Red Hat kernel) - [CVE-2019-10170](https://cve.now/CVE-2019-10170.md): A flaw was found in the Keycloak admin console, where the realm management interface permits a script to be set via the policy. (CVSS 6.6, \[UNKNOWN\] keycloak · org.keycloak:keycloak-core) - [CVE-2019-10169](https://cve.now/CVE-2019-10169.md): A flaw was found in Keycloak’s user-managed access interface, where it would permit a script to be set in the UMA policy. (CVSS 6.6, \[UNKNOWN\] keycloak · org.keycloak:keycloak-authz-client) - [CVE-2020-11541](https://cve.now/CVE-2020-11541.md): In TechSmith SnagIt 11.2.1 through 20.0.3, an XML External Entity (XXE) injection issue exists that would allow a local attacker to exfiltra (no CVSS) - [CVE-2020-7290](https://cve.now/CVE-2020-7290.md): Privilege Escalation vulnerability in MAR for Linux (CVSS 7.8, McAfee Active Response (MAR) for Linux) - [CVE-2020-7291](https://cve.now/CVE-2020-7291.md): Privilege Escalation vulnerability MAR for Mac (CVSS 7.8, McAfee Active Response (MAR) for Mac) - [CVE-2020-7287](https://cve.now/CVE-2020-7287.md): Privilege Escalation vulnerability in EDR for Linux (CVSS 7.8, McAfee Exploit Detection and Response (EDR) for Linux) - [CVE-2020-7288](https://cve.now/CVE-2020-7288.md): Privilege Escalation vulnerability in EDR for Mac (CVSS 7.8, McAfee Exploit Detection and Response (EDR) for Mac) - [CVE-2020-7289](https://cve.now/CVE-2020-7289.md): Privilege Escalation vulnerability in MAR for Windows (CVSS 7.8, McAfee Active Response (MAR) for Windows) - [CVE-2020-7285](https://cve.now/CVE-2020-7285.md): Privilege Escalation vulnerability in MVISION Endpoint (CVSS 7.8, McAfee MVISION Endpoint) - [CVE-2020-7286](https://cve.now/CVE-2020-7286.md): Privilege Escalation vulnerability in EDR for Windows (CVSS 7.8, McAfee Exploit Detection and Response (EDR) for Windows) - [CVE-2020-7267](https://cve.now/CVE-2020-7267.md): Privilege Escalation vulnerability through symbolic links in VSEL (CVSS 8.8, McAfee VirusScan Enterprise (VSE) for Linux) - [CVE-2020-5741](https://cve.now/CVE-2020-5741.md): Deserialization of Untrusted Data in Plex Media Server on Windows allows a remote, authenticated attacker to execute arbitrary Python code. (CVSS 7.2, KEV, Plex Media Server) - [CVE-2020-12680](https://cve.now/CVE-2020-12680.md): Avira Free Antivirus through 15.0.2005.1866 allows local users to discover user credentials. (no CVSS) - [CVE-2020-7266](https://cve.now/CVE-2020-7266.md): Privilege Escalation vulnerability through symbolic links in VSE for Windows (CVSS 8.8, McAfee VirusScan Enterprise (VSE) for Windows) - [CVE-2020-12018](https://cve.now/CVE-2020-12018.md): Advantech WebAccess Node, Version 8.4.4 and prior, Version 9.0.0. (no CVSS, Advantech WebAccess Node) - [CVE-2020-12002](https://cve.now/CVE-2020-12002.md): Advantech WebAccess Node, Version 8.4.4 and prior, Version 9.0.0. (no CVSS, Advantech WebAccess Node) - [CVE-2020-7265](https://cve.now/CVE-2020-7265.md): Privilege Escalation vulnerability through symbolic links in ENSM (CVSS 8.8, McAfee Endpoint Security (ENS) for Mac) - [CVE-2020-10638](https://cve.now/CVE-2020-10638.md): Advantech WebAccess Node, Version 8.4.4 and prior, Version 9.0.0. (no CVSS, Advantech WebAccess Node) - [CVE-2020-12026](https://cve.now/CVE-2020-12026.md): Advantech WebAccess Node, Version 8.4.4 and prior, Version 9.0.0. (no CVSS, Advantech WebAccess Node) - [CVE-2020-12014](https://cve.now/CVE-2020-12014.md): Advantech WebAccess Node, Version 8.4.4 and prior, Version 9.0.0. (no CVSS, Advantech WebAccess Node) - [CVE-2020-7264](https://cve.now/CVE-2020-7264.md): Privilege Escalation vulnerability through symbolic links in ENS for Windows (CVSS 8.8, McAfee Endpoint Security (ENS) for Windows) - [CVE-2020-12006](https://cve.now/CVE-2020-12006.md): Advantech WebAccess Node, Version 8.4.4 and prior, Version 9.0.0. (no CVSS, Advantech WebAccess Node) - [CVE-2020-12010](https://cve.now/CVE-2020-12010.md): Advantech WebAccess Node, Version 8.4.4 and prior, Version 9.0.0. (no CVSS, Advantech WebAccess Node) - [CVE-2020-12022](https://cve.now/CVE-2020-12022.md): Advantech WebAccess Node, Version 8.4.4 and prior, Version 9.0.0. (no CVSS, Advantech WebAccess Node) - [CVE-2020-12735](https://cve.now/CVE-2020-12735.md): reset.php in DomainMOD 4.13.0 uses insufficient entropy for password reset requests, leading to account takeover. (no CVSS) - [CVE-2012-0953](https://cve.now/CVE-2012-0953.md): Kernel heap contents leak race in ioctl handler (CVSS 5.0, nvidia graphics drivers) - [CVE-2012-0952](https://cve.now/CVE-2012-0952.md): Heap overflow in control device ioctl (CVSS 5.0, nvidia graphics drivers) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2020-05-08 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.