CVEs published May 13, 2020
61 CVEs were published on May 13, 2020: 1 critical, 23 high.
- Published
- 61
- Critical
- 1
- High
- 23
- Medium
- 13
- Low
- 3
- Unrated
- 21
- Now in CISA KEV
- 0
- Fix available
- 42
Most affected products
- Palo Alto Networks PAN-OS
- 23
- TYPO3 CMS · typo3/cms-core +1
- 6
- FreeBSD
- 5
- directmailteam/direct-mail
- 4
- Cisco ClamAV
- 2
- IPC-HX2XXX Series,IPC-HXXX5X4X Series,IPC-HX5842H,IPC-HX784…
- 2
- Canonical Subiquity
- 1
- IBM Sterling B2B Integrator
- 1
- IT Analytics
- 1
- MichaelAquilina zsh-autoswitch-virtualenv
- 1
Critical 1
High 23
- CVE-2020-11069Cross-Site Request Forgery in TYPO3 CMSTYPO3 CMS · typo3/cms-core +1
- CVE-2020-11067Deserialization of Untrusted Data in TYPO3 CMSTYPO3 CMS · typo3/cms-core +1
- CVE-2020-5409Concourse Open Redirect in the /sky/login endpointPivotal Concourse
- CVE-2020-11066Improperly Controlled Modification of Dynamically-Determined Object Attributes in TYPO3 CMSTYPO3 CMS · typo3/cms-core +1
- CVE-2020-2017PAN-OS: DOM-Based cross site scripting vulnerability in management web interfacePalo Alto Networks PAN-OS
- CVE-2020-2016PAN-OS: Temporary file race condition vulnerability in PAN-OS leads to local privilege escalationPalo Alto Networks PAN-OS
- CVE-2020-2015PAN-OS: Buffer overflow in the management serverPalo Alto Networks PAN-OS
- CVE-2020-2014PAN-OS: OS injection vulnerability in PAN-OS management serverPalo Alto Networks PAN-OS
- CVE-2020-2013PAN-OS: Panorama context switch session cookie disclosurePalo Alto Networks PAN-OS
- CVE-2020-2012PAN-OS: Panorama: XML external entity reference ('XXE') vulnerability leads the to information leakPalo Alto Networks PAN-OS
- CVE-2020-2011PAN-OS: Panorama registration denial of servicePalo Alto Networks PAN-OS
- CVE-2020-2010PAN-OS: Authenticated user command injection vulnerabilityPalo Alto Networks PAN-OS
- CVE-2020-2009PAN-OS: Panorama SD WAN arbitrary file creationPalo Alto Networks PAN-OS
- CVE-2020-2008PAN-OS: OS command injection or arbitrary file deletion vulnerabilityPalo Alto Networks PAN-OS
- CVE-2020-2007PAN-OS: OS command injection in management serverPalo Alto Networks PAN-OS
- CVE-2020-2006PAN-OS: Buffer overflow in management server payload parserPalo Alto Networks PAN-OS
- CVE-2020-2005PAN-OS: GlobalProtect Clientless VPN session hijackingPalo Alto Networks PAN-OS
- CVE-2020-2002PAN-OS: Spoofed Kerberos key distribution center authentication bypassPalo Alto Networks PAN-OS
- CVE-2020-2001PAN-OS: Panorama External control of file vulnerability leads to privilege escalationPalo Alto Networks PAN-OS
- CVE-2020-11073Remote Code Execution in Autoswitch Python VirtualenvMichaelAquilina zsh-autoswitch-virtualenv
- CVE-2020-1714A flaw was found in Keycloak before version 11.0.0, where the code base contains usages of ObjectInputStream without type checks.Red Hat keycloak · org.keycloak:keycloak-core +1
- CVE-2020-3341ClamAV PDF Parsing Denial of Service VulnerabilityCisco ClamAV
- CVE-2020-3327ClamAV ARJ Archive Parsing Denial of Service VulnerabilityCisco ClamAV
Medium, low and unrated 37
- CVE-2020-11065Cross-Site Scripting in TYPO3 CMSTYPO3 CMS · typo3/cms-core +1
- CVE-2020-11064Cross-Site Scripting in TYPO3 CMSTYPO3 CMS · typo3/cms-core +1
- CVE-2020-11063Observable Response Discrepancy in TYPO3 CMSTYPO3 CMS · typo3/cms-core +1
- CVE-2020-2004GlobalProtect App: Passwords may be logged in clear text while collecting troubleshooting logsPalo Alto Networks GlobalProtect App
- CVE-2020-2003PAN-OS: Authenticated administrator can delete arbitrary system filePalo Alto Networks PAN-OS
- CVE-2020-1998PAN-OS: Improper SAML SSO authorization of shared local usersPalo Alto Networks PAN-OS
- CVE-2020-1997PAN-OS: GlobalProtect registration open redirectPalo Alto Networks PAN-OS
- CVE-2020-1996PAN-OS: Panorama management server log injectionPalo Alto Networks PAN-OS
- CVE-2020-1995PAN-OS: Management server rasmgr denial of servicePalo Alto Networks PAN-OS
- CVE-2020-1994PAN-OS: Predictable temporary file vulnerabilityPalo Alto Networks PAN-OS
- CVE-2020-1993PAN-OS: GlobalProtect Portal PHP session fixation vulnerabilityPalo Alto Networks PAN-OS
- CVE-2020-11070Cross-Site Scripting in SVG SanitizerTYPO3GmbH svg_sanitizer · t3g/svg-sanitizer
- CVE-2020-12832WordPress Plugin Simple File List before 4.2.8 is prone to a vulnerability that lets attackers delete arbitrary files because the applicatio
- CVE-2020-12831An issue was discovered in FRRouting FRR (aka Free Range Routing) through 7.3.1.
- CVE-2020-5407Signature Wrapping Vulnerability with spring-security-saml2-service-providerSpring by VMware Spring Security · org.springframework.secu…
- CVE-2019-2388Potential exposure of log information in Ops ManagerMongoDB Ops Manager
- CVE-2020-5838Symantec IT Analytics, prior to 2.9.1, may be susceptible to a cross-site scripting (XSS) exploit, which is a type of issue that can potentiIT Analytics
- CVE-2019-15880In FreeBSD 12.1-STABLE before r356911, and 12.1-RELEASE before p5, insufficient checking in the cryptodev module allocated the size of a kerFreeBSD
- CVE-2019-15879In FreeBSD 12.1-STABLE before r356908, 12.1-RELEASE before p5, 11.3-STABLE before r356908, and 11.3-RELEASE before p9, a race condition in tFreeBSD
- CVE-2019-15878In FreeBSD 12.1-STABLE before r352509, 11.3-STABLE before r352509, and 11.3-RELEASE before p9, an unprivileged local user can trigger a use-FreeBSD
- CVE-2020-7455In FreeBSD 12.1-STABLE before r360973, 12.1-RELEASE before p5, 11.4-STABLE before r360973, 11.4-BETA1 before p1 and 11.3-RELEASE before p9, FreeBSD
- CVE-2020-7454In FreeBSD 12.1-STABLE before r360971, 12.1-RELEASE before p5, 11.4-STABLE before r360971, 11.4-BETA1 before p1 and 11.3-RELEASE before p9, FreeBSD
- CVE-2020-9502Some Dahua products with Build time before December 2019 have Session ID predictable vulnerabilities.IPC-HX2XXX Series,IPC-HXXX5X4X Series,IPC-HX5842H,IPC-HX784…
- CVE-2020-9501Attackers can obtain Cloud Key information from the Dahua Web P2P control in specific ways.Web P2P control,P2P plartform server,client tools
- CVE-2019-9682Dahua devices with Build time before December 2019 use strong security login mode by default, but in order to be compatible with the normal IPC-HX2XXX Series,IPC-HXXX5X4X Series,IPC-HX5842H,IPC-HX784…
- CVE-2020-8020Persistent XSS in markdown parser used by obs-serveropenSUSE open-build-service
- CVE-2019-16112TylerTech Eagle 2018.3.11 deserializes untrusted user input, resulting in remote code execution via a crafted Java object to the recorder/Se
- CVE-2020-12427The Western Digital WD Discovery application before 3.8.229 for MyCloud Home on Windows and macOS is vulnerable to CSRF, with impacts such a
- CVE-2020-12763TRENDnet ProView Wireless camera TV-IP512WN 1.0R 1.0.4 is vulnerable to an unauthenticated stack-based buffer overflow in handling RTSP pack
- CVE-2020-12742The iubenda-cookie-law-solution plugin before 2.3.5 for WordPress does not restrict URL sanitization to http protocols.
- CVE-2020-12700The direct_mail extension through 5.2.3 for TYPO3 allows Information Disclosure via a newsletter subscriber data Special Query.directmailteam/direct-mail
- CVE-2020-12699The direct_mail extension through 5.2.3 for TYPO3 has an Open Redirect via jumpUrl.directmailteam/direct-mail
- CVE-2020-12698The direct_mail extension through 5.2.3 for TYPO3 has Broken Access Control for newsletter subscriber tables.directmailteam/direct-mail
- CVE-2020-12697The direct_mail extension through 5.2.3 for TYPO3 allows Denial of Service via log entries.directmailteam/direct-mail
- CVE-2020-10654Ping Identity PingID SSH before 4.0.14 contains a heap buffer overflow in PingID-enrolled servers.
- CVE-2020-4312IBM Sterling B2B Integrator Standard Edition 5.2.0.0 trough 6.0.3.1 could allow an authenticated user to obtain sensitive information from aIBM Sterling B2B Integrator
- CVE-2020-11932Subiquity server installer logged LUKS full disk encryption passwordCanonical Subiquity