CVEs published May 14, 2020
70 CVEs were published on May 14, 2020: 0 critical, 16 high.
- Published
- 70
- Critical
- 0
- High
- 16
- Medium
- 6
- Low
- 0
- Unrated
- 48
- Now in CISA KEV
- 0
- Fix available
- 8
Most affected products
- Android
- 22
- IBM i2 Analysts Notebook
- 15
- Opto 22 SoftPAC Project
- 5
- Six Apart Movable Type
- 4
- Apache ActiveMQ · org.apache.activemq:activemq-web-console
- 1
- Apache Ant · org.apache.ant:ant
- 1
- Apache Camel · org.apache.camel:camel +2
- 1
- Apache Camel · org.apache.camel:camel-netty
- 1
- Apache Camel · org.apache.camel:camel-rabbitmq
- 1
- Apache CloudStack
- 1
High 16
- CVE-2020-12877Veritas APTARE versions prior to 10.4 allowed sensitive information to be accessible without authentication.
- CVE-2020-4468IBM i2 Intelligent Analyis Platform 9.2.1 could allow a remote attacker to execute arbitrary code on the system, caused by memory corruptionIBM i2 Analysts Notebook
- CVE-2020-4467IBM i2 Intelligent Analyis Platform 9.2.1 could allow a remote attacker to execute arbitrary code on the system, caused by memory corruptionIBM i2 Analysts Notebook
- CVE-2020-4422IBM i2 Intelligent Analyis Platform 9.2.1 could allow a remote attacker to execute arbitrary code on the system, caused by a memory corruptiIBM i2 Analysts Notebook
- CVE-2020-4343IBM i2 Intelligent Analyis Platform 9.2.1 could allow a remote attacker to execute arbitrary code on the system, caused by a memory corruptiIBM i2 Analysts Notebook
- CVE-2020-4288IBM i2 Intelligent Analyis Platform 9.2.1 could allow a remote attacker to execute arbitrary code on the system, caused by a memory corruptiIBM i2 Analysts Notebook
- CVE-2020-4287IBM i2 Intelligent Analyis Platform 9.2.1 could allow a remote attacker to execute arbitrary code on the system, caused by a memory corruptiIBM i2 Analysts Notebook
- CVE-2020-4285IBM i2 Intelligent Analyis Platform 9.2.1 could allow a remote attacker to execute arbitrary code on the system, caused by a memory corruptiIBM i2 Analysts Notebook
- CVE-2020-4266IBM i2 Intelligent Analyis Platform 9.2.1 could allow a local attacker to execute arbitrary code on the system, caused by a memory corruptioIBM i2 Analysts Notebook
- CVE-2020-4265IBM i2 Intelligent Analyis Platform 9.2.1 could allow a local attacker to execute arbitrary code on the system, caused by a memory corruptioIBM i2 Analysts Notebook
- CVE-2020-4264IBM i2 Intelligent Analyis Platform 9.2.1 could allow a local attacker to execute arbitrary code on the system, caused by a memory corruptioIBM i2 Analysts Notebook
- CVE-2020-4263IBM i2 Intelligent Analyis Platform 9.2.1 could allow a local attacker to execute arbitrary code on the system, caused by a memory corruptioIBM i2 Analysts Notebook
- CVE-2020-4262IBM i2 Intelligent Analyis Platform 9.2.1 could allow a local attacker to execute arbitrary code on the system, caused by a memory corruptioIBM i2 Analysts Notebook
- CVE-2020-4261IBM i2 Intelligent Analyis Platform 9.2.1 could allow a local attacker to execute arbitrary code on the system, caused by a memory corruptioIBM i2 Analysts Notebook
- CVE-2020-4258IBM i2 Intelligent Analyis Platform 9.2.1 could allow a local attacker to execute arbitrary code on the system, caused by a memory corruptioIBM i2 Analysts Notebook
- CVE-2020-4257IBM i2 Intelligent Analyis Platform 9.2.1 could allow a local attacker to execute arbitrary code on the system, caused by a memory corruptioIBM i2 Analysts Notebook
Medium, low and unrated 54
- CVE-2020-10620Opto 22 SoftPAC Project Version 9.6 and prior.Opto 22 SoftPAC Project
- CVE-2020-10616Opto 22 SoftPAC Project Version 9.6 and prior.Opto 22 SoftPAC Project
- CVE-2020-10612Opto 22 SoftPAC Project Version 9.6 and prior.Opto 22 SoftPAC Project
- CVE-2020-12046Opto 22 SoftPAC Project Version 9.6 and prior.Opto 22 SoftPAC Project
- CVE-2020-12068An issue was discovered in CODESYS Development System before 3.5.16.0.
- CVE-2020-12042Opto 22 SoftPAC Project Version 9.6 and prior.Opto 22 SoftPAC Project
- CVE-2020-0221Airbrush FW's scratch memory allocator is susceptible to numeric overflow.Android
- CVE-2020-0220In crus_afe_callback of msm-cirrus-playback.c, there is a possible out of bounds write due to a missing bounds check.Android
- CVE-2020-0100In onTransact of IHDCP.cpp, there is a possible out of bounds read due to incorrect error handling.Android
- CVE-2020-0064An improper authorization while processing the provisioning data.Product: AndroidVersions: Android SoCAndroid ID: A-149866855Android
- CVE-2020-0065An improper authorization in the receiver component of the Android Suite Daemon.Product: AndroidVersions: Android SoCAndroid ID: A-149813448Android
- CVE-2020-0090An improper authorization in the receiver component of Email.Product: AndroidVersions: Android SoCAndroid ID: A-149813048Android
- CVE-2020-0091In mnld, an incorrect configuration in driver_cfg of mnld for meta factory mode.Product: AndroidVersions: Android SoCAndroid ID: A-149808700Android
- CVE-2020-0093In exif_data_save_data_entry of exif-data.c, there is a possible out of bounds read due to a missing bounds check.Android
- CVE-2020-0106In getCellLocation of PhoneInterfaceManager.java, there is a possible permission bypass due to a missing SDK version check.Android
- CVE-2020-0094In setImageHeight and setImageWidth of ExifUtils.cpp, there is a possible out of bounds write due to an incorrect bounds check.Android
- CVE-2020-0110In psi_write of psi.c, there is a possible out of bounds write due to a missing bounds check.Android
- CVE-2020-0103In a2dp_aac_decoder_cleanup of a2dp_aac_decoder.cc, there is a possible invalid free due to memory corruption.Android
- CVE-2020-0109In simulatePackageSuspendBroadcast of NotificationManagerService.java, there is a missing permission check.Android
- CVE-2020-0097In various methods of PackageManagerService.java, there is a possible permission bypass due to a missing condition for system apps.Android
- CVE-2020-0096In startActivities of ActivityStartController.java, there is a possible escalation of privilege due to a confused deputy.Android
- CVE-2020-0092In setHideSensitive of NotificationStackScrollLayout.java, there is a possible disclosure of sensitive notification content due to a permissAndroid
- CVE-2020-0101In BnCrypto::onTransact of ICrypto.cpp, there is a possible information disclosure due to uninitialized data.Android
- CVE-2020-0104In onShowingStateChanged of KeyguardStateMonitor.java, there is a possible inappropriate read due to a logic error.Android
- CVE-2020-0098In navigateUpToLocked of ActivityStack.java, there is a possible permission bypass due to a confused deputy.Android
- CVE-2020-0105In onKeyguardVisibilityChanged of key_store_service.cpp, there is a missing permission check.Android
- CVE-2020-0102In GattServer::SendResponse of gatt_server.cc, there is a possible out of bounds write due to an incorrect bounds check.Android
- CVE-2020-0024In onCreate of SettingsBaseActivity.java, there is a possible unauthorized setting modification due to a permissions bypass.Android
- CVE-2020-12874Veritas APTARE versions prior to 10.4 included code that bypassed the normal login process when specific authentication credentials were pro
- CVE-2020-12875Veritas APTARE versions prior to 10.4 did not perform adequate authorization checks.
- CVE-2020-12876Veritas APTARE versions prior to 10.4 allowed remote users to access several unintended files on the server.
- CVE-2020-12677An issue was discovered in Progress MOVEit Automation Web Admin.
- CVE-2020-5408Dictionary attack with Spring Security queryable text encryptorSpring by VMware Spring Security · org.springframework.secu…
- CVE-2020-1941In Apache ActiveMQ 5.0.0 to 5.15.11, the webconsole admin GUI is open to XSS, in the view that lists the contents of a queue.Apache ActiveMQ · org.apache.activemq:activemq-web-console
- CVE-2020-11972Apache Camel RabbitMQ enables Java deserialization by default.Apache Camel · org.apache.camel:camel-rabbitmq
- CVE-2020-11973Apache Camel Netty enables Java deserialization by default.Apache Camel · org.apache.camel:camel-netty
- CVE-2019-13023An issue was discovered in all versions of Bond JetSelect.
- CVE-2020-11971Apache Camel's JMX is vulnerable to Rebind Flaw.Apache Camel · org.apache.camel:camel +2
- CVE-2019-13022Bond JetSelect (all versions) has an issue in the Java class (ENCtool.jar) and corresponding password generation algorithm (used to set init
- CVE-2019-13021The administrative passwords for all versions of Bond JetSelect are stored within an unprotected file on the filesystem, rather than encrypt
- CVE-2019-17562A buffer overflow vulnerability has been found in the baremetal component of Apache CloudStack.Apache CloudStack
- CVE-2019-17572In Apache RocketMQ 4.2.0 to 4.6.0, when the automatic topic creation in the broker is turned on by default, an evil topic like “../../../../Apache RocketMQ · org.apache.rocketmq:rocketmq-broker
- CVE-2020-1960A vulnerability in Apache Flink (1.1.0 to 1.1.5, 1.2.0 to 1.2.1, 1.3.0 to 1.3.3, 1.4.0 to 1.4.2, 1.5.0 to 1.5.6, 1.6.0 to 1.6.4, 1.7.0 to 1.Apache Flink · org.apache.flink:flink-core
- CVE-2020-1945Apache Ant 1.1 to 1.9.14 and 1.10.0 to 1.10.7 uses the default temporary directory identified by the Java system property java.io.tmpdir forApache Ant · org.apache.ant:ant
- CVE-2020-10626In Fazecast jSerialComm, Version 2.2.2 and prior, an uncontrolled search path element vulnerability could allow a malicious DLL file with thFazecast jSerialComm,
- CVE-2020-4365IBM WebSphere Application Server 8.5 is vulnerable to server-side request forgery.IBM WebSphere Application Server
- CVE-2020-4299IBM Sterling B2B Integrator Standard Edition 5.2.0.0 through 6.0.3.1 could expose sensitive information to a user through a specially crafteIBM Sterling B2B Integrator
- CVE-2020-4259IBM Sterling File Gateway 2.2.0.0 through 6.0.3.1 could allow an authenticated user could manipulate cookie information and remove or add moIBM Sterling File Gateway
- CVE-2019-15083Default installations of Zoho ManageEngine ServiceDesk Plus 10.0 before 10500 are vulnerable to XSS injected by a workstation local administ
- CVE-2020-12717The COVIDSafe (Australia) app 1.0 and 1.1 for iOS allows a remote attacker to crash the app, and consequently interfere with COVID-19 contac
- CVE-2020-5576Cross-site request forgery (CSRF) vulnerability in Movable Type series (Movable Type 7 r.4606 (7.2.1) and earlier (Movable Type 7), Movable Six Apart Movable Type
- CVE-2020-5577Movable Type series (Movable Type 7 r.4606 (7.2.1) and earlier (Movable Type 7), Movable Type Advanced 7 r.4606 (7.2.1) and earlier (MovableSix Apart Movable Type
- CVE-2020-5574HTML attribute value injection vulnerability in Movable Type series (Movable Type 7 r.4606 (7.2.1) and earlier (Movable Type 7), Movable TypSix Apart Movable Type
- CVE-2020-5575Cross-site scripting vulnerability in Movable Type series (Movable Type 7 r.4606 (7.2.1) and earlier (Movable Type 7), Movable Type AdvancedSix Apart Movable Type