# CVEs published 2020-05-12 47 CVEs were published on May 12, 2020: 5 critical, 11 high. Days are UTC. - [CVE-2020-11057](https://cve.now/CVE-2020-11057.md): Code Injection in XWiki Platform (CVSS 9.9, XWiki Platform) - [CVE-2020-1718](https://cve.now/CVE-2020-1718.md): A flaw was found in the reset credential flow in all Keycloak versions before 8.0.0. (CVSS 7.1, Red Hat keycloak · org.keycloak:keycloak-parent) - [CVE-2020-12772](https://cve.now/CVE-2020-12772.md): An issue was discovered in Ignite Realtime Spark 2.8.3 (and the ROAR plugin for it) on Windows. (no CVSS) - [CVE-2020-11060](https://cve.now/CVE-2020-11060.md): Remote Code Execution in GLPI (CVSS 7.4, glpi-project GLPI) - [CVE-2020-11062](https://cve.now/CVE-2020-11062.md): Reflexive XSS in GLPI (CVSS 6.0, GLPI) - [CVE-2020-12826](https://cve.now/CVE-2020-12826.md): A signal access-control issue was discovered in the Linux kernel before 5.6.5, aka CID-7395ea4e65c2. (no CVSS) - [CVE-2020-6242](https://cve.now/CVE-2020-6242.md): SAP Business Objects Business Intelligence Platform (Live Data Connect), versions 1.0, 2.0, 2.1, 2.2, 2.3, allows an attacker to logon on th (CVSS 9.8, SAP SE SAP Business Objects Business Intelligence Platform) - [CVE-2020-6258](https://cve.now/CVE-2020-6258.md): SAP Identity Management, version 8.0, does not perform necessary authorization checks for an authenticated user, allowing the attacker to vi (CVSS 4.3, SAP SE SAP Identity Management) - [CVE-2020-6254](https://cve.now/CVE-2020-6254.md): SAP Enterprise Threat Detection, versions 1.0, 2.0, does not sufficiently encode error response pages in case of errors, allowing XSS payloa (CVSS 6.1, SAP SE SAP Enterprise Threat Detection) - [CVE-2020-6241](https://cve.now/CVE-2020-6241.md): SAP Adaptive Server Enterprise, version 16.0, allows an authenticated user to execute crafted database queries to elevate privileges of user (CVSS 8.8, SAP SE SAP Adaptive Server Enterprise) - [CVE-2020-6259](https://cve.now/CVE-2020-6259.md): Under certain conditions SAP Adaptive Server Enterprise, versions 15.7, 16.0, allows an attacker to access information which would otherwise (CVSS 6.5, SAP SE SAP Adaptive Server Enterprise) - [CVE-2020-6252](https://cve.now/CVE-2020-6252.md): Under certain conditions SAP Adaptive Server Enterprise (Cockpit), version 16.0, allows an attacker with access to local network, to get sen (CVSS 9.0, SAP SE SAP Adaptive Server Enterprise) - [CVE-2020-6253](https://cve.now/CVE-2020-6253.md): Under certain conditions, SAP Adaptive Server Enterprise (Web Services), versions 15.7, 16.0, allows an authenticated user to execute crafte (CVSS 7.2, SAP SE SAP Adaptive Server Enterprise) - [CVE-2020-6244](https://cve.now/CVE-2020-6244.md): SAP Business Client, version 7.0, allows an attacker after a successful social engineering attack to inject malicious code as a DLL file in (CVSS 7.0, SAP SE SAP Business Client) - [CVE-2020-6257](https://cve.now/CVE-2020-6257.md): SAP Business Objects Business Intelligence Platform (CMC and BI Launchpad) 4.2 does not sufficiently encode user-controlled inputs, resultin (CVSS 5.4, SAP SE SAP Business Objects Business Intelligence Platform) - [CVE-2020-6250](https://cve.now/CVE-2020-6250.md): SAP Adaptive Server Enterprise, version 16.0, allows an authenticated attacker to exploit certain misconfigured endpoints exposed over the a (CVSS 6.8, SAP SE SAP Adaptive Server Enterprise) - [CVE-2020-6262](https://cve.now/CVE-2020-6262.md): Service Data Download in SAP Application Server ABAP (ST-PI, before versions 2008\_1\_46C, 2008\_1\_620, 2008\_1\_640, 2008\_1\_700, 2008\_1\_710, 740 (CVSS 9.9, SAP SE SAP Application Server ABAP) - [CVE-2020-6256](https://cve.now/CVE-2020-6256.md): SAP Master Data Governance, versions - 748, 749, 750, 751, 752, 800, 801, 802, 803, 804, allows users to display change request details with (CVSS 5.4, SAP SE SAP Master Data Governance) - [CVE-2020-6248](https://cve.now/CVE-2020-6248.md): SAP Adaptive Server Enterprise (Backup Server), version 16.0, does not perform the necessary validation checks for an authenticated user whi (CVSS 9.1, SAP SE SAP Adaptive Server Enterprise) - [CVE-2020-6251](https://cve.now/CVE-2020-6251.md): Under certain conditions or error scenarios SAP Business Objects Business Intelligence Platform, version 4.2, allows an attacker to access i (CVSS 5.4, SAP SE SAP BusinessObjects Business Intelligence Platform) - [CVE-2020-6247](https://cve.now/CVE-2020-6247.md): SAP Business Objects Business Intelligence Platform, version 4.2, allows an unauthenticated attacker to prevent legitimate users from access (CVSS 5.9, SAP SE SAP Business Objects Business Intelligence Platform) - [CVE-2020-6245](https://cve.now/CVE-2020-6245.md): SAP Business Objects Business Intelligence Platform, version 4.2, allows an attacker with access to local instance, to inject file or code t (CVSS 6.5, SAP SE SAP Business Objects Business Intelligence Platform) - [CVE-2020-6249](https://cve.now/CVE-2020-6249.md): The use of an admin backend report within SAP Master Data Governance, versions - S4CORE 101, S4FND 102, 103, 104, SAP\_BS\_FND 748; allows an (CVSS 7.7, SAP SE SAP Master Data Governance) - [CVE-2020-6243](https://cve.now/CVE-2020-6243.md): Under certain conditions, SAP Adaptive Server Enterprise (XP Server on Windows Platform), versions 15.7, 16.0, does not perform the necessar (CVSS 8.0, SAP SE SAP Adaptive Server Enterprise) - [CVE-2020-6240](https://cve.now/CVE-2020-6240.md): SAP NetWeaver AS ABAP (Web Dynpro ABAP), versions (SAP\_UI 750, 752, 753, 754 and SAP\_BASIS 700, 710, 730, 731, 804) allows an unauthenticate (CVSS 5.3, SAP SE SAP NetWeaver AS ABAP (Web Dynpro ABAP)) - [CVE-2020-12825](https://cve.now/CVE-2020-12825.md): libcroco through 0.6.13 has excessive recursion in cr\_parser\_parse\_any\_core in cr-parser.c, leading to stack consumption. (no CVSS) - [CVE-2020-1746](https://cve.now/CVE-2020-1746.md): A flaw was found in the Ansible Engine affecting Ansible Engine versions 2.7.x before 2.7.17 and 2.8.x before 2.8.11 and 2.9.x before 2.9.7 (CVSS 5.0, Red Hat ansible · ansible) - [CVE-2020-12823](https://cve.now/CVE-2020-12823.md): OpenConnect 8.09 has a buffer overflow, causing a denial of service (application crash) or possibly unspecified other impact, via crafted ce (no CVSS) - [CVE-2020-5248](https://cve.now/CVE-2020-5248.md): Public GLPIKEY can be used to decrypt any data in GLPI (CVSS 7.2, glpi-project glpi) - [CVE-2020-5898](https://cve.now/CVE-2020-5898.md): In versions 7.1.5-7.1.9, BIG-IP Edge Client Windows Stonewall driver does not sanitize the pointer received from the userland. (no CVSS, F5 Edge Client) - [CVE-2020-5896](https://cve.now/CVE-2020-5896.md): On versions 7.1.5-7.1.9, the BIG-IP Edge Client's Windows Installer Service's temporary folder has weak file and folder permissions. (no CVSS, F5 Edge Client) - [CVE-2020-5897](https://cve.now/CVE-2020-5897.md): In versions 7.1.5-7.1.9, there is use-after-free memory vulnerability in the BIG-IP Edge Client Windows ActiveX component. (no CVSS, F5 Edge Client) - [CVE-2020-1939](https://cve.now/CVE-2020-1939.md): The Apache NuttX (Incubating) project provides an optional separate "apps" repository which contains various optional components and example (no CVSS, Apache NuttX) - [CVE-2020-10706](https://cve.now/CVE-2020-10706.md): A flaw was found in OpenShift Container Platform where OAuth tokens are not encrypted when the encryption of data at rest is enabled. (CVSS 6.3, \[UNKNOWN\] openshift/openshift-apiserver) - [CVE-2020-1763](https://cve.now/CVE-2020-1763.md): An out-of-bounds buffer read flaw was found in the pluto daemon of libreswan from versions 3.27 till 3.31 where, an unauthenticated attacker (CVSS 7.5, the libreswan Project libreswan) - [CVE-2020-4346](https://cve.now/CVE-2020-4346.md): IBM API Connect's V2018.4.1.0 through 2018.4.1.10 management server has an unsecured api which can be exploited by an unauthenticated attack (CVSS 5.3, IBM API Connect) - [CVE-2020-4195](https://cve.now/CVE-2020-4195.md): IBM API Connect V2018.4.1.0 through 2018.4.1.10 could allow a remote attacker to hijack the clicking action of the victim. (CVSS 5.4, IBM API Connect) - [CVE-2019-4478](https://cve.now/CVE-2019-4478.md): IBM Maximo Asset Management 7.6.0, and 7.6.1 could allow an authenticated user to obtain highly sensitive information that they should not n (CVSS 6.5, IBM Maximo Asset Management) - [CVE-2020-8159](https://cve.now/CVE-2020-8159.md): There is a vulnerability in actionpack\_page-caching gem \< v1.2.1 that allows an attacker to write arbitrary files to a web server, potential (no CVSS, https://github.com/rails/actionpack-page\_caching · actionpa…) - [CVE-2020-8151](https://cve.now/CVE-2020-8151.md): There is a possible information disclosure issue in Active Resource \