# CVEs published 2020-05-13

61 CVEs were published on May 13, 2020: 1 critical, 23 high. Days are UTC.

- [CVE-2020-11069](https://cve.now/CVE-2020-11069.md): Cross-Site Request Forgery in TYPO3 CMS (CVSS 8.0, TYPO3 CMS · typo3/cms-core +1)
- [CVE-2020-11067](https://cve.now/CVE-2020-11067.md): Deserialization of Untrusted Data in TYPO3 CMS (CVSS 8.8, TYPO3 CMS · typo3/cms-core +1)
- [CVE-2020-5409](https://cve.now/CVE-2020-5409.md): Concourse Open Redirect in the /sky/login endpoint (CVSS 7.6, Pivotal Concourse)
- [CVE-2020-11066](https://cve.now/CVE-2020-11066.md): Improperly Controlled Modification of Dynamically-Determined Object Attributes in TYPO3 CMS (CVSS 8.7, TYPO3 CMS · typo3/cms-core +1)
- [CVE-2020-11065](https://cve.now/CVE-2020-11065.md): Cross-Site Scripting in TYPO3 CMS (CVSS 5.4, TYPO3 CMS · typo3/cms-core +1)
- [CVE-2020-11064](https://cve.now/CVE-2020-11064.md): Cross-Site Scripting in TYPO3 CMS (CVSS 5.4, TYPO3 CMS · typo3/cms-core +1)
- [CVE-2020-11063](https://cve.now/CVE-2020-11063.md): Observable Response Discrepancy in TYPO3 CMS (CVSS 3.7, TYPO3 CMS · typo3/cms-core +1)
- [CVE-2020-2018](https://cve.now/CVE-2020-2018.md): PAN-OS: Panorama authentication bypass vulnerability (CVSS 9.0, Palo Alto Networks PAN-OS)
- [CVE-2020-2017](https://cve.now/CVE-2020-2017.md): PAN-OS: DOM-Based cross site scripting vulnerability in management web interface (CVSS 8.8, Palo Alto Networks PAN-OS)
- [CVE-2020-2016](https://cve.now/CVE-2020-2016.md): PAN-OS: Temporary file race condition vulnerability in PAN-OS leads to local privilege escalation (CVSS 7.0, Palo Alto Networks PAN-OS)
- [CVE-2020-2015](https://cve.now/CVE-2020-2015.md): PAN-OS: Buffer overflow in the management server (CVSS 8.8, Palo Alto Networks PAN-OS)
- [CVE-2020-2014](https://cve.now/CVE-2020-2014.md): PAN-OS: OS injection vulnerability in PAN-OS management server (CVSS 8.8, Palo Alto Networks PAN-OS)
- [CVE-2020-2013](https://cve.now/CVE-2020-2013.md): PAN-OS: Panorama context switch session cookie disclosure (CVSS 8.3, Palo Alto Networks PAN-OS)
- [CVE-2020-2012](https://cve.now/CVE-2020-2012.md): PAN-OS: Panorama: XML external entity reference ('XXE') vulnerability leads the to information leak (CVSS 7.5, Palo Alto Networks PAN-OS)
- [CVE-2020-2011](https://cve.now/CVE-2020-2011.md): PAN-OS: Panorama registration denial of service (CVSS 7.5, Palo Alto Networks PAN-OS)
- [CVE-2020-2010](https://cve.now/CVE-2020-2010.md): PAN-OS: Authenticated user command injection vulnerability (CVSS 7.2, Palo Alto Networks PAN-OS)
- [CVE-2020-2009](https://cve.now/CVE-2020-2009.md): PAN-OS: Panorama SD WAN arbitrary file creation (CVSS 7.2, Palo Alto Networks PAN-OS)
- [CVE-2020-2008](https://cve.now/CVE-2020-2008.md): PAN-OS: OS command injection or arbitrary file deletion vulnerability (CVSS 7.2, Palo Alto Networks PAN-OS)
- [CVE-2020-2007](https://cve.now/CVE-2020-2007.md): PAN-OS: OS command injection in management server (CVSS 7.2, Palo Alto Networks PAN-OS)
- [CVE-2020-2006](https://cve.now/CVE-2020-2006.md): PAN-OS: Buffer overflow in management server payload parser (CVSS 7.2, Palo Alto Networks PAN-OS)
- [CVE-2020-2005](https://cve.now/CVE-2020-2005.md): PAN-OS: GlobalProtect Clientless VPN session hijacking (CVSS 7.1, Palo Alto Networks PAN-OS)
- [CVE-2020-2004](https://cve.now/CVE-2020-2004.md): GlobalProtect App: Passwords may be logged in clear text while collecting troubleshooting logs (CVSS 6.8, Palo Alto Networks GlobalProtect App)
- [CVE-2020-2003](https://cve.now/CVE-2020-2003.md): PAN-OS: Authenticated administrator can delete arbitrary system file (CVSS 6.5, Palo Alto Networks PAN-OS)
- [CVE-2020-2002](https://cve.now/CVE-2020-2002.md): PAN-OS: Spoofed Kerberos key distribution center authentication bypass (CVSS 8.1, Palo Alto Networks PAN-OS)
- [CVE-2020-2001](https://cve.now/CVE-2020-2001.md): PAN-OS: Panorama External control of file vulnerability leads to privilege escalation (CVSS 8.1, Palo Alto Networks PAN-OS)
- [CVE-2020-1998](https://cve.now/CVE-2020-1998.md): PAN-OS: Improper SAML SSO authorization of shared local users (CVSS 5.4, Palo Alto Networks PAN-OS)
- [CVE-2020-1997](https://cve.now/CVE-2020-1997.md): PAN-OS: GlobalProtect registration open redirect (CVSS 5.3, Palo Alto Networks PAN-OS)
- [CVE-2020-1996](https://cve.now/CVE-2020-1996.md): PAN-OS: Panorama management server log injection (CVSS 5.3, Palo Alto Networks PAN-OS)
- [CVE-2020-1995](https://cve.now/CVE-2020-1995.md): PAN-OS: Management server rasmgr denial of service (CVSS 4.9, Palo Alto Networks PAN-OS)
- [CVE-2020-1994](https://cve.now/CVE-2020-1994.md): PAN-OS: Predictable temporary file vulnerability (CVSS 4.1, Palo Alto Networks PAN-OS)
- [CVE-2020-1993](https://cve.now/CVE-2020-1993.md): PAN-OS: GlobalProtect Portal PHP session fixation vulnerability (CVSS 3.7, Palo Alto Networks PAN-OS)
- [CVE-2020-11073](https://cve.now/CVE-2020-11073.md): Remote Code Execution in Autoswitch Python Virtualenv (CVSS 7.9, MichaelAquilina zsh-autoswitch-virtualenv)
- [CVE-2020-11070](https://cve.now/CVE-2020-11070.md): Cross-Site Scripting in SVG Sanitizer (CVSS 5.4, TYPO3GmbH svg\_sanitizer · t3g/svg-sanitizer)
- [CVE-2020-1714](https://cve.now/CVE-2020-1714.md): A flaw was found in Keycloak before version 11.0.0, where the code base contains usages of ObjectInputStream without type checks. (CVSS 7.5, Red Hat keycloak · org.keycloak:keycloak-core +1)
- [CVE-2020-12832](https://cve.now/CVE-2020-12832.md): WordPress Plugin Simple File List before 4.2.8 is prone to a vulnerability that lets attackers delete arbitrary files because the applicatio (no CVSS)
- [CVE-2020-12831](https://cve.now/CVE-2020-12831.md): An issue was discovered in FRRouting FRR (aka Free Range Routing) through 7.3.1. (no CVSS)
- [CVE-2020-5407](https://cve.now/CVE-2020-5407.md): Signature Wrapping Vulnerability with spring-security-saml2-service-provider (no CVSS, Spring by VMware Spring Security · org.springframework.secu…)
- [CVE-2019-2388](https://cve.now/CVE-2019-2388.md): Potential exposure of log information in Ops Manager (CVSS 5.8, MongoDB Ops Manager)
- [CVE-2020-5838](https://cve.now/CVE-2020-5838.md): Symantec IT Analytics, prior to 2.9.1, may be susceptible to a cross-site scripting (XSS) exploit, which is a type of issue that can potenti (no CVSS, IT Analytics)
- [CVE-2019-15880](https://cve.now/CVE-2019-15880.md): In FreeBSD 12.1-STABLE before r356911, and 12.1-RELEASE before p5, insufficient checking in the cryptodev module allocated the size of a ker (no CVSS, FreeBSD)
- [CVE-2019-15879](https://cve.now/CVE-2019-15879.md): In FreeBSD 12.1-STABLE before r356908, 12.1-RELEASE before p5, 11.3-STABLE before r356908, and 11.3-RELEASE before p9, a race condition in t (no CVSS, FreeBSD)
- [CVE-2019-15878](https://cve.now/CVE-2019-15878.md): In FreeBSD 12.1-STABLE before r352509, 11.3-STABLE before r352509, and 11.3-RELEASE before p9, an unprivileged local user can trigger a use- (no CVSS, FreeBSD)
- [CVE-2020-7455](https://cve.now/CVE-2020-7455.md): In FreeBSD 12.1-STABLE before r360973, 12.1-RELEASE before p5, 11.4-STABLE before r360973, 11.4-BETA1 before p1 and 11.3-RELEASE before p9, (no CVSS, FreeBSD)
- [CVE-2020-7454](https://cve.now/CVE-2020-7454.md): In FreeBSD 12.1-STABLE before r360971, 12.1-RELEASE before p5, 11.4-STABLE before r360971, 11.4-BETA1 before p1 and 11.3-RELEASE before p9, (no CVSS, FreeBSD)
- [CVE-2020-9502](https://cve.now/CVE-2020-9502.md): Some Dahua products with Build time before December 2019 have Session ID predictable vulnerabilities. (no CVSS, IPC-HX2XXX Series,IPC-HXXX5X4X Series,IPC-HX5842H,IPC-HX784…)
- [CVE-2020-9501](https://cve.now/CVE-2020-9501.md): Attackers can obtain Cloud Key information from the Dahua Web P2P control in specific ways. (no CVSS, Web P2P control,P2P plartform server,client tools)
- [CVE-2019-9682](https://cve.now/CVE-2019-9682.md): Dahua devices with Build time before December 2019 use strong security login mode by default, but in order to be compatible with the normal (no CVSS, IPC-HX2XXX Series,IPC-HXXX5X4X Series,IPC-HX5842H,IPC-HX784…)
- [CVE-2020-8020](https://cve.now/CVE-2020-8020.md): Persistent XSS in markdown parser used by obs-server (CVSS 6.5, openSUSE open-build-service)
- [CVE-2019-16112](https://cve.now/CVE-2019-16112.md): TylerTech Eagle 2018.3.11 deserializes untrusted user input, resulting in remote code execution via a crafted Java object to the recorder/Se (no CVSS)
- [CVE-2020-12427](https://cve.now/CVE-2020-12427.md): The Western Digital WD Discovery application before 3.8.229 for MyCloud Home on Windows and macOS is vulnerable to CSRF, with impacts such a (no CVSS)
- [CVE-2020-12763](https://cve.now/CVE-2020-12763.md): TRENDnet ProView Wireless camera TV-IP512WN 1.0R 1.0.4 is vulnerable to an unauthenticated stack-based buffer overflow in handling RTSP pack (no CVSS)
- [CVE-2020-12742](https://cve.now/CVE-2020-12742.md): The iubenda-cookie-law-solution plugin before 2.3.5 for WordPress does not restrict URL sanitization to http protocols. (no CVSS)
- [CVE-2020-12700](https://cve.now/CVE-2020-12700.md): The direct\_mail extension through 5.2.3 for TYPO3 allows Information Disclosure via a newsletter subscriber data Special Query. (no CVSS, directmailteam/direct-mail)
- [CVE-2020-12699](https://cve.now/CVE-2020-12699.md): The direct\_mail extension through 5.2.3 for TYPO3 has an Open Redirect via jumpUrl. (no CVSS, directmailteam/direct-mail)
- [CVE-2020-12698](https://cve.now/CVE-2020-12698.md): The direct\_mail extension through 5.2.3 for TYPO3 has Broken Access Control for newsletter subscriber tables. (no CVSS, directmailteam/direct-mail)
- [CVE-2020-12697](https://cve.now/CVE-2020-12697.md): The direct\_mail extension through 5.2.3 for TYPO3 allows Denial of Service via log entries. (no CVSS, directmailteam/direct-mail)
- [CVE-2020-10654](https://cve.now/CVE-2020-10654.md): Ping Identity PingID SSH before 4.0.14 contains a heap buffer overflow in PingID-enrolled servers. (no CVSS)
- [CVE-2020-4312](https://cve.now/CVE-2020-4312.md): IBM Sterling B2B Integrator Standard Edition 5.2.0.0 trough 6.0.3.1 could allow an authenticated user to obtain sensitive information from a (CVSS 4.3, IBM Sterling B2B Integrator)
- [CVE-2020-3341](https://cve.now/CVE-2020-3341.md): ClamAV PDF Parsing Denial of Service Vulnerability (CVSS 7.5, Cisco ClamAV)
- [CVE-2020-3327](https://cve.now/CVE-2020-3327.md): ClamAV ARJ Archive Parsing Denial of Service Vulnerability (CVSS 7.5, Cisco ClamAV)
- [CVE-2020-11932](https://cve.now/CVE-2020-11932.md): Subiquity server installer logged LUKS full disk encryption password (CVSS 2.3, Canonical Subiquity)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2020-05-13
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.