CVEs published May 12, 2020
47 CVEs were published on May 12, 2020: 5 critical, 11 high.
- Published
- 47
- Critical
- 5
- High
- 11
- Medium
- 16
- Low
- 1
- Unrated
- 14
- Now in CISA KEV
- 0
- Fix available
- 30
Most affected products
- SAP SE SAP Adaptive Server Enterprise
- 7
- SAP SE SAP Business Objects Business Intelligence Platform
- 4
- F5 Edge Client
- 3
- IBM API Connect
- 2
- Nextcloud Server
- 2
- SAP SE SAP Master Data Governance
- 2
- [UNKNOWN] openshift/openshift-apiserver
- 1
- Apache NuttX
- 1
- FreeRDP
- 1
- GLPI
- 1
Critical 5
- CVE-2020-11057Code Injection in XWiki PlatformXWiki Platform
- CVE-2020-6242SAP Business Objects Business Intelligence Platform (Live Data Connect), versions 1.0, 2.0, 2.1, 2.2, 2.3, allows an attacker to logon on thSAP SE SAP Business Objects Business Intelligence Platform
- CVE-2020-6252Under certain conditions SAP Adaptive Server Enterprise (Cockpit), version 16.0, allows an attacker with access to local network, to get senSAP SE SAP Adaptive Server Enterprise
- CVE-2020-6262Service Data Download in SAP Application Server ABAP (ST-PI, before versions 2008_1_46C, 2008_1_620, 2008_1_640, 2008_1_700, 2008_1_710, 740SAP SE SAP Application Server ABAP
- CVE-2020-6248SAP Adaptive Server Enterprise (Backup Server), version 16.0, does not perform the necessary validation checks for an authenticated user whiSAP SE SAP Adaptive Server Enterprise
High 11
- CVE-2020-1718A flaw was found in the reset credential flow in all Keycloak versions before 8.0.0.Red Hat keycloak · org.keycloak:keycloak-parent
- CVE-2020-11060Remote Code Execution in GLPIglpi-project GLPI
- CVE-2020-6241SAP Adaptive Server Enterprise, version 16.0, allows an authenticated user to execute crafted database queries to elevate privileges of userSAP SE SAP Adaptive Server Enterprise
- CVE-2020-6253Under certain conditions, SAP Adaptive Server Enterprise (Web Services), versions 15.7, 16.0, allows an authenticated user to execute crafteSAP SE SAP Adaptive Server Enterprise
- CVE-2020-6244SAP Business Client, version 7.0, allows an attacker after a successful social engineering attack to inject malicious code as a DLL file in SAP SE SAP Business Client
- CVE-2020-6249The use of an admin backend report within SAP Master Data Governance, versions - S4CORE 101, S4FND 102, 103, 104, SAP_BS_FND 748; allows an SAP SE SAP Master Data Governance
- CVE-2020-6243Under certain conditions, SAP Adaptive Server Enterprise (XP Server on Windows Platform), versions 15.7, 16.0, does not perform the necessarSAP SE SAP Adaptive Server Enterprise
- CVE-2020-5248Public GLPIKEY can be used to decrypt any data in GLPIglpi-project glpi
- CVE-2020-1763An out-of-bounds buffer read flaw was found in the pluto daemon of libreswan from versions 3.27 till 3.31 where, an unauthenticated attackerthe libreswan Project libreswan
- CVE-2020-11072False-negative validation results in MINT transactions with invalid batonsimpleledger slp-validate · slp-validate
- CVE-2020-11071False-negative validation results in MINT transactions with invalid batonsimpleledger slpjs · slpjs
Medium, low and unrated 31
- CVE-2020-12772An issue was discovered in Ignite Realtime Spark 2.8.3 (and the ROAR plugin for it) on Windows.
- CVE-2020-11062Reflexive XSS in GLPIGLPI
- CVE-2020-12826A signal access-control issue was discovered in the Linux kernel before 5.6.5, aka CID-7395ea4e65c2.
- CVE-2020-6258SAP Identity Management, version 8.0, does not perform necessary authorization checks for an authenticated user, allowing the attacker to viSAP SE SAP Identity Management
- CVE-2020-6254SAP Enterprise Threat Detection, versions 1.0, 2.0, does not sufficiently encode error response pages in case of errors, allowing XSS payloaSAP SE SAP Enterprise Threat Detection
- CVE-2020-6259Under certain conditions SAP Adaptive Server Enterprise, versions 15.7, 16.0, allows an attacker to access information which would otherwiseSAP SE SAP Adaptive Server Enterprise
- CVE-2020-6257SAP Business Objects Business Intelligence Platform (CMC and BI Launchpad) 4.2 does not sufficiently encode user-controlled inputs, resultinSAP SE SAP Business Objects Business Intelligence Platform
- CVE-2020-6250SAP Adaptive Server Enterprise, version 16.0, allows an authenticated attacker to exploit certain misconfigured endpoints exposed over the aSAP SE SAP Adaptive Server Enterprise
- CVE-2020-6256SAP Master Data Governance, versions - 748, 749, 750, 751, 752, 800, 801, 802, 803, 804, allows users to display change request details withSAP SE SAP Master Data Governance
- CVE-2020-6251Under certain conditions or error scenarios SAP Business Objects Business Intelligence Platform, version 4.2, allows an attacker to access iSAP SE SAP BusinessObjects Business Intelligence Platform
- CVE-2020-6247SAP Business Objects Business Intelligence Platform, version 4.2, allows an unauthenticated attacker to prevent legitimate users from accessSAP SE SAP Business Objects Business Intelligence Platform
- CVE-2020-6245SAP Business Objects Business Intelligence Platform, version 4.2, allows an attacker with access to local instance, to inject file or code tSAP SE SAP Business Objects Business Intelligence Platform
- CVE-2020-6240SAP NetWeaver AS ABAP (Web Dynpro ABAP), versions (SAP_UI 750, 752, 753, 754 and SAP_BASIS 700, 710, 730, 731, 804) allows an unauthenticateSAP SE SAP NetWeaver AS ABAP (Web Dynpro ABAP)
- CVE-2020-12825libcroco through 0.6.13 has excessive recursion in cr_parser_parse_any_core in cr-parser.c, leading to stack consumption.
- CVE-2020-1746A flaw was found in the Ansible Engine affecting Ansible Engine versions 2.7.x before 2.7.17 and 2.8.x before 2.8.11 and 2.9.x before 2.9.7 Red Hat ansible · ansible
- CVE-2020-12823OpenConnect 8.09 has a buffer overflow, causing a denial of service (application crash) or possibly unspecified other impact, via crafted ce
- CVE-2020-5898In versions 7.1.5-7.1.9, BIG-IP Edge Client Windows Stonewall driver does not sanitize the pointer received from the userland.F5 Edge Client
- CVE-2020-5896On versions 7.1.5-7.1.9, the BIG-IP Edge Client's Windows Installer Service's temporary folder has weak file and folder permissions.F5 Edge Client
- CVE-2020-5897In versions 7.1.5-7.1.9, there is use-after-free memory vulnerability in the BIG-IP Edge Client Windows ActiveX component.F5 Edge Client
- CVE-2020-1939The Apache NuttX (Incubating) project provides an optional separate "apps" repository which contains various optional components and exampleApache NuttX
- CVE-2020-10706A flaw was found in OpenShift Container Platform where OAuth tokens are not encrypted when the encryption of data at rest is enabled.[UNKNOWN] openshift/openshift-apiserver
- CVE-2020-4346IBM API Connect's V2018.4.1.0 through 2018.4.1.10 management server has an unsecured api which can be exploited by an unauthenticated attackIBM API Connect
- CVE-2020-4195IBM API Connect V2018.4.1.0 through 2018.4.1.10 could allow a remote attacker to hijack the clicking action of the victim.IBM API Connect
- CVE-2019-4478IBM Maximo Asset Management 7.6.0, and 7.6.1 could allow an authenticated user to obtain highly sensitive information that they should not nIBM Maximo Asset Management
- CVE-2020-8159There is a vulnerability in actionpack_page-caching gem < v1.2.1 that allows an attacker to write arbitrary files to a web server, potentialhttps://github.com/rails/actionpack-page_caching · actionpa…
- CVE-2020-8151There is a possible information disclosure issue in Active Resource <v5.1.1 that could allow an attacker to create specially crafted requesthttps://github.com/rails/activeresource · activeresource
- CVE-2020-8153Improper access control in Groupfolders app 4.0.3 allowed to delete hidden directories when when renaming an accessible item to the same namNextcloud Groupfolders
- CVE-2020-8155An outdated 3rd party library in the Files PDF viewer for Nextcloud Server 18.0.2 caused a Cross-site scripting vulnerability when opening aNextcloud Server
- CVE-2020-8154An Insecure direct object reference vulnerability in Nextcloud Server 18.0.2 allowed an attacker to remote wipe devices of other users when Nextcloud Server
- CVE-2020-8156A missing verification of the TLS host in Nextcloud Mail 1.1.3 allowed a man in the middle attack.Nextcloud Mail
- CVE-2020-11058Improper Restriction of Operations within the Bounds of a Memory Buffer in FreeRDPFreeRDP