CVEs published May 11, 2020
47 CVEs were published on May 11, 2020: 1 critical, 9 high.
- Published
- 47
- Critical
- 1
- High
- 9
- Medium
- 6
- Low
- 0
- Unrated
- 31
- Now in CISA KEV
- 0
- Fix available
- 8
Most affected products
- zephyrproject-rtos zephyr
- 11
- Symantec Endpoint Protection Manager
- 3
- Red Hat keycloak · org.keycloak:keycloak-core
- 2
- Symantec Endpoint Protection
- 2
- Apache log4net · log4net
- 1
- IBM UrbanCode Deploy
- 1
- io.jooby:jooby and org.jooby:jooby · io.jooby:jooby +1
- 1
- JAL Information Technology Co. PALLET CONTROL
- 1
- NetApp Service Processor and Baseboard Management Controller
- 1
- nystudio107/craft-seomatic
- 1
Critical 1
High 9
- CVE-2020-10067Integer Overflow In is_in_region Allows User Thread To Access Kernel Memoryzephyrproject-rtos zephyr
- CVE-2020-10060UpdateHub Might Dereference An Uninitialized Pointerzephyrproject-rtos zephyr
- CVE-2020-10058Multiple Syscalls In kscan Subsystem Performs No Argument Validationzephyrproject-rtos zephyr
- CVE-2020-10028Multiple Syscalls In GPIO Subsystem Performs No Argument Validationzephyrproject-rtos zephyr
- CVE-2020-10027ARC Platform Uses Signed Integer Comparison When Validating Syscall Numberszephyrproject-rtos zephyr
- CVE-2020-10024ARM Platform Uses Signed Integer Comparison When Validating Syscall Numberszephyrproject-rtos zephyr
- CVE-2020-10021Out-of-bounds write in USB Mass Storage with unaligned sizeszephyrproject-rtos zephyr
- CVE-2020-10019Buffer Overflow in USB DFU requested lengthzephyrproject-rtos zephyr
- CVE-2019-19162A use-after-free vulnerability in the TOBESOFT XPLATFORM versions 9.1 to 9.2.2 may lead to code execution on a system running it.TOBESOFT XPLATFORM
Medium, low and unrated 37
- CVE-2020-10059UpdateHub Module Explicitly Disables TLS Verificationzephyrproject-rtos zephyr
- CVE-2020-10023Shell Subsystem Contains a Buffer Overflow Vulnerability In shell_spaces_trimzephyrproject-rtos zephyr
- CVE-2020-1724A flaw was found in Keycloak in versions before 9.0.2.Red Hat keycloak · org.keycloak:keycloak-core
- CVE-2020-9840In SwiftNIO Extras before 1.4.1, a logic issue was addressed with improved restrictions.SwiftNIO Extras
- CVE-2020-7647All versions before 1.6.7 and all versions after 2.0.0 inclusive and before 2.8.2 of io.jooby:jooby and org.jooby:jooby are vulnerable to Diio.jooby:jooby and org.jooby:jooby · io.jooby:jooby +1
- CVE-2020-5837Symantec Endpoint Protection, prior to 14.3, may not respect file permissions when writing to log files that are replaced by symbolic links,Symantec Endpoint Protection
- CVE-2020-5836Symantec Endpoint Protection, prior to 14.3, can potentially reset the ACLs on a file as a limited user while Symantec Endpoint Protection'sSymantec Endpoint Protection
- CVE-2020-5835Symantec Endpoint Protection Manager, prior to 14.3, has a race condition in client remote deployment which may result in an elevation of prSymantec Endpoint Protection Manager
- CVE-2020-5834Symantec Endpoint Protection Manager, prior to 14.3, may be susceptible to a directory traversal attack that could allow a remote actor to dSymantec Endpoint Protection Manager
- CVE-2020-5833Symantec Endpoint Protection Manager, prior to 14.3, may be susceptible to an out of bounds vulnerability, which is a type of issue that resSymantec Endpoint Protection Manager
- CVE-2020-12790In the SEOmatic plugin before 3.2.49 for Craft CMS, helpers/DynamicMeta.php does not properly sanitize the URL.nystudio107/craft-seomatic
- CVE-2019-5500Certain versions of the NetApp Service Processor and Baseboard Management Controller firmware allow a remote unauthenticated attacker to cauNetApp Service Processor and Baseboard Management Controller
- CVE-2019-4667IBM UrbanCode Deploy (UCD) 7.0.5.2 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HIBM UrbanCode Deploy
- CVE-2018-1285Apache log4net versions before 2.0.10 do not disable XML external entities when parsing log4net configuration files.Apache log4net · log4net
- CVE-2020-12760An issue was discovered in OpenNMS Horizon before 26.0.1, and Meridian before 2018.1.19 and 2019 before 2019.1.7.org.opennms.core:org.opennms.core.daemon
- CVE-2020-12785cPanel before 86.0.14 allows attackers to obtain access to the current working directory via the account backup feature (SEC-540).
- CVE-2020-12784cPanel before 86.0.14 allows remote attackers to trigger a bandwidth suspension via mail log strings (SEC-505).
- CVE-2020-12754An issue was discovered on LG mobile devices with Android OS 7.2, 8.0, 8.1, 9, and 10 software.
- CVE-2020-12753An issue was discovered on LG mobile devices with Android OS 7.2, 8.0, 8.1, 9, and 10 software.
- CVE-2020-12752An issue was discovered on Samsung mobile devices with P(9.0) and Q(10.0) (with TEEGRIS) software.
- CVE-2020-12751An issue was discovered on Samsung mobile devices with O(8.X), P(9.0), and Q(10.0) software.
- CVE-2020-12750An issue was discovered on Samsung mobile devices with Q(10.0) software.
- CVE-2020-12749An issue was discovered on Samsung mobile devices with P(9.0) (Exynos chipsets) software.
- CVE-2020-12748An issue was discovered on Samsung mobile devices with Q(10.0) software.
- CVE-2020-12747An issue was discovered on Samsung mobile devices with Q(10.0) (Exynos980 9630 and Exynos990 9830 chipsets) software.
- CVE-2020-12746An issue was discovered on Samsung mobile devices with O(8.X), P(9.0), and Q(10.0) (Exynos chipsets) software.
- CVE-2020-11866libEMF (aka ECMA-234 Metafile Library) through 1.0.11 allows a use-after-free.
- CVE-2020-11865libEMF (aka ECMA-234 Metafile Library) through 1.0.11 allows out-of-bounds memory access.
- CVE-2020-11864libEMF (aka ECMA-234 Metafile Library) through 1.0.11 allows denial of service (issue 2 of 2).
- CVE-2020-11863libEMF (aka ECMA-234 Metafile Library) through 1.0.11 allows denial of service (issue 1 of 2).
- CVE-2020-12745An issue was discovered on Samsung mobile devices with Q(10.0) software.
- CVE-2020-11108The Gravity updater in Pi-hole through 4.4 allows an authenticated adversary to upload arbitrary files.
- CVE-2020-12783Exim through 4.93 has an out-of-bounds read in the SPA authenticator that could result in SPA/NTLM authentication bypass in auths/spa.c and
- CVE-2020-1698A flaw was found in keycloak in versions before 9.0.0.Red Hat keycloak · org.keycloak:keycloak-core
- CVE-2020-12743An issue was discovered in Gazie 7.32.
- CVE-2020-5538Improper Access Control in PALLET CONTROL Ver.JAL Information Technology Co. PALLET CONTROL
- CVE-2020-10685A flaw was found in Ansible Engine affecting Ansible Engine versions 2.7.x before 2.7.17 and 2.8.x before 2.8.11 and 2.9.x before 2.9.7 as wRed Hat Ansible · ansible