# CVEs published 2020-05-11

47 CVEs were published on May 11, 2020: 1 critical, 9 high. Days are UTC.

- [CVE-2020-10067](https://cve.now/CVE-2020-10067.md): Integer Overflow In is\_in\_region Allows User Thread To Access Kernel Memory (CVSS 7.5, zephyrproject-rtos zephyr)
- [CVE-2020-10060](https://cve.now/CVE-2020-10060.md): UpdateHub Might Dereference An Uninitialized Pointer (CVSS 8.0, zephyrproject-rtos zephyr)
- [CVE-2020-10059](https://cve.now/CVE-2020-10059.md): UpdateHub Module Explicitly Disables TLS Verification (CVSS 4.8, zephyrproject-rtos zephyr)
- [CVE-2020-10058](https://cve.now/CVE-2020-10058.md): Multiple Syscalls In kscan Subsystem Performs No Argument Validation (CVSS 7.8, zephyrproject-rtos zephyr)
- [CVE-2020-10028](https://cve.now/CVE-2020-10028.md): Multiple Syscalls In GPIO Subsystem Performs No Argument Validation (CVSS 7.8, zephyrproject-rtos zephyr)
- [CVE-2020-10027](https://cve.now/CVE-2020-10027.md): ARC Platform Uses Signed Integer Comparison When Validating Syscall Numbers (CVSS 7.8, zephyrproject-rtos zephyr)
- [CVE-2020-10024](https://cve.now/CVE-2020-10024.md): ARM Platform Uses Signed Integer Comparison When Validating Syscall Numbers (CVSS 7.8, zephyrproject-rtos zephyr)
- [CVE-2020-10023](https://cve.now/CVE-2020-10023.md): Shell Subsystem Contains a Buffer Overflow Vulnerability In shell\_spaces\_trim (CVSS 6.9, zephyrproject-rtos zephyr)
- [CVE-2020-10022](https://cve.now/CVE-2020-10022.md): UpdateHub Module Copies a Variable-Size Hash String Into a Fixed-Size Array (CVSS 9.0, zephyrproject-rtos zephyr)
- [CVE-2020-10021](https://cve.now/CVE-2020-10021.md): Out-of-bounds write in USB Mass Storage with unaligned sizes (CVSS 8.1, zephyrproject-rtos zephyr)
- [CVE-2020-10019](https://cve.now/CVE-2020-10019.md): Buffer Overflow in USB DFU requested length (CVSS 8.1, zephyrproject-rtos zephyr)
- [CVE-2020-1724](https://cve.now/CVE-2020-1724.md): A flaw was found in Keycloak in versions before 9.0.2. (CVSS 4.3, Red Hat keycloak · org.keycloak:keycloak-core)
- [CVE-2020-9840](https://cve.now/CVE-2020-9840.md): In SwiftNIO Extras before 1.4.1, a logic issue was addressed with improved restrictions. (no CVSS, SwiftNIO Extras)
- [CVE-2020-7647](https://cve.now/CVE-2020-7647.md): All versions before 1.6.7 and all versions after 2.0.0 inclusive and before 2.8.2 of io.jooby:jooby and org.jooby:jooby are vulnerable to Di (no CVSS, io.jooby:jooby and org.jooby:jooby · io.jooby:jooby +1)
- [CVE-2020-5837](https://cve.now/CVE-2020-5837.md): Symantec Endpoint Protection, prior to 14.3, may not respect file permissions when writing to log files that are replaced by symbolic links, (no CVSS, Symantec Endpoint Protection)
- [CVE-2020-5836](https://cve.now/CVE-2020-5836.md): Symantec Endpoint Protection, prior to 14.3, can potentially reset the ACLs on a file as a limited user while Symantec Endpoint Protection's (no CVSS, Symantec Endpoint Protection)
- [CVE-2020-5835](https://cve.now/CVE-2020-5835.md): Symantec Endpoint Protection Manager, prior to 14.3, has a race condition in client remote deployment which may result in an elevation of pr (no CVSS, Symantec Endpoint Protection Manager)
- [CVE-2020-5834](https://cve.now/CVE-2020-5834.md): Symantec Endpoint Protection Manager, prior to 14.3, may be susceptible to a directory traversal attack that could allow a remote actor to d (no CVSS, Symantec Endpoint Protection Manager)
- [CVE-2020-5833](https://cve.now/CVE-2020-5833.md): Symantec Endpoint Protection Manager, prior to 14.3, may be susceptible to an out of bounds vulnerability, which is a type of issue that res (no CVSS, Symantec Endpoint Protection Manager)
- [CVE-2020-12790](https://cve.now/CVE-2020-12790.md): In the SEOmatic plugin before 3.2.49 for Craft CMS, helpers/DynamicMeta.php does not properly sanitize the URL. (no CVSS, nystudio107/craft-seomatic)
- [CVE-2019-5500](https://cve.now/CVE-2019-5500.md): Certain versions of the NetApp Service Processor and Baseboard Management Controller firmware allow a remote unauthenticated attacker to cau (no CVSS, NetApp Service Processor and Baseboard Management Controller)
- [CVE-2019-19162](https://cve.now/CVE-2019-19162.md): A use-after-free vulnerability in the TOBESOFT XPLATFORM versions 9.1 to 9.2.2 may lead to code execution on a system running it. (CVSS 7.8, TOBESOFT XPLATFORM)
- [CVE-2019-4667](https://cve.now/CVE-2019-4667.md): IBM UrbanCode Deploy (UCD) 7.0.5.2 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable H (CVSS 5.9, IBM UrbanCode Deploy)
- [CVE-2018-1285](https://cve.now/CVE-2018-1285.md): Apache log4net versions before 2.0.10 do not disable XML external entities when parsing log4net configuration files. (no CVSS, Apache log4net · log4net)
- [CVE-2020-12760](https://cve.now/CVE-2020-12760.md): An issue was discovered in OpenNMS Horizon before 26.0.1, and Meridian before 2018.1.19 and 2019 before 2019.1.7. (no CVSS, org.opennms.core:org.opennms.core.daemon)
- [CVE-2020-12785](https://cve.now/CVE-2020-12785.md): cPanel before 86.0.14 allows attackers to obtain access to the current working directory via the account backup feature (SEC-540). (no CVSS)
- [CVE-2020-12784](https://cve.now/CVE-2020-12784.md): cPanel before 86.0.14 allows remote attackers to trigger a bandwidth suspension via mail log strings (SEC-505). (no CVSS)
- [CVE-2020-12754](https://cve.now/CVE-2020-12754.md): An issue was discovered on LG mobile devices with Android OS 7.2, 8.0, 8.1, 9, and 10 software. (no CVSS)
- [CVE-2020-12753](https://cve.now/CVE-2020-12753.md): An issue was discovered on LG mobile devices with Android OS 7.2, 8.0, 8.1, 9, and 10 software. (no CVSS)
- [CVE-2020-12752](https://cve.now/CVE-2020-12752.md): An issue was discovered on Samsung mobile devices with P(9.0) and Q(10.0) (with TEEGRIS) software. (no CVSS)
- [CVE-2020-12751](https://cve.now/CVE-2020-12751.md): An issue was discovered on Samsung mobile devices with O(8.X), P(9.0), and Q(10.0) software. (no CVSS)
- [CVE-2020-12750](https://cve.now/CVE-2020-12750.md): An issue was discovered on Samsung mobile devices with Q(10.0) software. (no CVSS)
- [CVE-2020-12749](https://cve.now/CVE-2020-12749.md): An issue was discovered on Samsung mobile devices with P(9.0) (Exynos chipsets) software. (no CVSS)
- [CVE-2020-12748](https://cve.now/CVE-2020-12748.md): An issue was discovered on Samsung mobile devices with Q(10.0) software. (no CVSS)
- [CVE-2020-12747](https://cve.now/CVE-2020-12747.md): An issue was discovered on Samsung mobile devices with Q(10.0) (Exynos980 9630 and Exynos990 9830 chipsets) software. (no CVSS)
- [CVE-2020-12746](https://cve.now/CVE-2020-12746.md): An issue was discovered on Samsung mobile devices with O(8.X), P(9.0), and Q(10.0) (Exynos chipsets) software. (no CVSS)
- [CVE-2020-11866](https://cve.now/CVE-2020-11866.md): libEMF (aka ECMA-234 Metafile Library) through 1.0.11 allows a use-after-free. (no CVSS)
- [CVE-2020-11865](https://cve.now/CVE-2020-11865.md): libEMF (aka ECMA-234 Metafile Library) through 1.0.11 allows out-of-bounds memory access. (no CVSS)
- [CVE-2020-11864](https://cve.now/CVE-2020-11864.md): libEMF (aka ECMA-234 Metafile Library) through 1.0.11 allows denial of service (issue 2 of 2). (no CVSS)
- [CVE-2020-11863](https://cve.now/CVE-2020-11863.md): libEMF (aka ECMA-234 Metafile Library) through 1.0.11 allows denial of service (issue 1 of 2). (no CVSS)
- [CVE-2020-12745](https://cve.now/CVE-2020-12745.md): An issue was discovered on Samsung mobile devices with Q(10.0) software. (no CVSS)
- [CVE-2020-11108](https://cve.now/CVE-2020-11108.md): The Gravity updater in Pi-hole through 4.4 allows an authenticated adversary to upload arbitrary files. (no CVSS)
- [CVE-2020-12783](https://cve.now/CVE-2020-12783.md): Exim through 4.93 has an out-of-bounds read in the SPA authenticator that could result in SPA/NTLM authentication bypass in auths/spa.c and (no CVSS)
- [CVE-2020-1698](https://cve.now/CVE-2020-1698.md): A flaw was found in keycloak in versions before 9.0.0. (CVSS 5.0, Red Hat keycloak · org.keycloak:keycloak-core)
- [CVE-2020-12743](https://cve.now/CVE-2020-12743.md): An issue was discovered in Gazie 7.32. (no CVSS)
- [CVE-2020-5538](https://cve.now/CVE-2020-5538.md): Improper Access Control in PALLET CONTROL Ver. (no CVSS, JAL Information Technology Co. PALLET CONTROL)
- [CVE-2020-10685](https://cve.now/CVE-2020-10685.md): A flaw was found in Ansible Engine affecting Ansible Engine versions 2.7.x before 2.7.17 and 2.8.x before 2.8.11 and 2.9.x before 2.9.7 as w (CVSS 5.0, Red Hat Ansible · ansible)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2020-05-11
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.