# CVEs published 2020-05-14

70 CVEs were published on May 14, 2020: 0 critical, 16 high. Days are UTC.

- [CVE-2020-10620](https://cve.now/CVE-2020-10620.md): Opto 22 SoftPAC Project Version 9.6 and prior. (no CVSS, Opto 22 SoftPAC Project)
- [CVE-2020-10616](https://cve.now/CVE-2020-10616.md): Opto 22 SoftPAC Project Version 9.6 and prior. (no CVSS, Opto 22 SoftPAC Project)
- [CVE-2020-10612](https://cve.now/CVE-2020-10612.md): Opto 22 SoftPAC Project Version 9.6 and prior. (no CVSS, Opto 22 SoftPAC Project)
- [CVE-2020-12046](https://cve.now/CVE-2020-12046.md): Opto 22 SoftPAC Project Version 9.6 and prior. (no CVSS, Opto 22 SoftPAC Project)
- [CVE-2020-12068](https://cve.now/CVE-2020-12068.md): An issue was discovered in CODESYS Development System before 3.5.16.0. (no CVSS)
- [CVE-2020-12042](https://cve.now/CVE-2020-12042.md): Opto 22 SoftPAC Project Version 9.6 and prior. (no CVSS, Opto 22 SoftPAC Project)
- [CVE-2020-0221](https://cve.now/CVE-2020-0221.md): Airbrush FW's scratch memory allocator is susceptible to numeric overflow. (no CVSS, Android)
- [CVE-2020-0220](https://cve.now/CVE-2020-0220.md): In crus\_afe\_callback of msm-cirrus-playback.c, there is a possible out of bounds write due to a missing bounds check. (no CVSS, Android)
- [CVE-2020-0100](https://cve.now/CVE-2020-0100.md): In onTransact of IHDCP.cpp, there is a possible out of bounds read due to incorrect error handling. (no CVSS, Android)
- [CVE-2020-0064](https://cve.now/CVE-2020-0064.md): An improper authorization while processing the provisioning data.Product: AndroidVersions: Android SoCAndroid ID: A-149866855 (no CVSS, Android)
- [CVE-2020-0065](https://cve.now/CVE-2020-0065.md): An improper authorization in the receiver component of the Android Suite Daemon.Product: AndroidVersions: Android SoCAndroid ID: A-149813448 (no CVSS, Android)
- [CVE-2020-0090](https://cve.now/CVE-2020-0090.md): An improper authorization in the receiver component of Email.Product: AndroidVersions: Android SoCAndroid ID: A-149813048 (no CVSS, Android)
- [CVE-2020-0091](https://cve.now/CVE-2020-0091.md): In mnld, an incorrect configuration in driver\_cfg of mnld for meta factory mode.Product: AndroidVersions: Android SoCAndroid ID: A-149808700 (no CVSS, Android)
- [CVE-2020-0093](https://cve.now/CVE-2020-0093.md): In exif\_data\_save\_data\_entry of exif-data.c, there is a possible out of bounds read due to a missing bounds check. (no CVSS, Android)
- [CVE-2020-0106](https://cve.now/CVE-2020-0106.md): In getCellLocation of PhoneInterfaceManager.java, there is a possible permission bypass due to a missing SDK version check. (no CVSS, Android)
- [CVE-2020-0094](https://cve.now/CVE-2020-0094.md): In setImageHeight and setImageWidth of ExifUtils.cpp, there is a possible out of bounds write due to an incorrect bounds check. (no CVSS, Android)
- [CVE-2020-0110](https://cve.now/CVE-2020-0110.md): In psi\_write of psi.c, there is a possible out of bounds write due to a missing bounds check. (no CVSS, Android)
- [CVE-2020-0103](https://cve.now/CVE-2020-0103.md): In a2dp\_aac\_decoder\_cleanup of a2dp\_aac\_decoder.cc, there is a possible invalid free due to memory corruption. (no CVSS, Android)
- [CVE-2020-0109](https://cve.now/CVE-2020-0109.md): In simulatePackageSuspendBroadcast of NotificationManagerService.java, there is a missing permission check. (no CVSS, Android)
- [CVE-2020-0097](https://cve.now/CVE-2020-0097.md): In various methods of PackageManagerService.java, there is a possible permission bypass due to a missing condition for system apps. (no CVSS, Android)
- [CVE-2020-0096](https://cve.now/CVE-2020-0096.md): In startActivities of ActivityStartController.java, there is a possible escalation of privilege due to a confused deputy. (no CVSS, Android)
- [CVE-2020-0092](https://cve.now/CVE-2020-0092.md): In setHideSensitive of NotificationStackScrollLayout.java, there is a possible disclosure of sensitive notification content due to a permiss (no CVSS, Android)
- [CVE-2020-0101](https://cve.now/CVE-2020-0101.md): In BnCrypto::onTransact of ICrypto.cpp, there is a possible information disclosure due to uninitialized data. (no CVSS, Android)
- [CVE-2020-0104](https://cve.now/CVE-2020-0104.md): In onShowingStateChanged of KeyguardStateMonitor.java, there is a possible inappropriate read due to a logic error. (no CVSS, Android)
- [CVE-2020-0098](https://cve.now/CVE-2020-0098.md): In navigateUpToLocked of ActivityStack.java, there is a possible permission bypass due to a confused deputy. (no CVSS, Android)
- [CVE-2020-0105](https://cve.now/CVE-2020-0105.md): In onKeyguardVisibilityChanged of key\_store\_service.cpp, there is a missing permission check. (no CVSS, Android)
- [CVE-2020-0102](https://cve.now/CVE-2020-0102.md): In GattServer::SendResponse of gatt\_server.cc, there is a possible out of bounds write due to an incorrect bounds check. (no CVSS, Android)
- [CVE-2020-0024](https://cve.now/CVE-2020-0024.md): In onCreate of SettingsBaseActivity.java, there is a possible unauthorized setting modification due to a permissions bypass. (no CVSS, Android)
- [CVE-2020-12874](https://cve.now/CVE-2020-12874.md): Veritas APTARE versions prior to 10.4 included code that bypassed the normal login process when specific authentication credentials were pro (CVSS 6.5)
- [CVE-2020-12875](https://cve.now/CVE-2020-12875.md): Veritas APTARE versions prior to 10.4 did not perform adequate authorization checks. (CVSS 6.3)
- [CVE-2020-12877](https://cve.now/CVE-2020-12877.md): Veritas APTARE versions prior to 10.4 allowed sensitive information to be accessible without authentication. (CVSS 7.5)
- [CVE-2020-12876](https://cve.now/CVE-2020-12876.md): Veritas APTARE versions prior to 10.4 allowed remote users to access several unintended files on the server. (CVSS 5.3)
- [CVE-2020-12677](https://cve.now/CVE-2020-12677.md): An issue was discovered in Progress MOVEit Automation Web Admin. (no CVSS)
- [CVE-2020-5408](https://cve.now/CVE-2020-5408.md): Dictionary attack with Spring Security queryable text encryptor (no CVSS, Spring by VMware Spring Security · org.springframework.secu…)
- [CVE-2020-1941](https://cve.now/CVE-2020-1941.md): In Apache ActiveMQ 5.0.0 to 5.15.11, the webconsole admin GUI is open to XSS, in the view that lists the contents of a queue. (no CVSS, Apache ActiveMQ · org.apache.activemq:activemq-web-console)
- [CVE-2020-11972](https://cve.now/CVE-2020-11972.md): Apache Camel RabbitMQ enables Java deserialization by default. (no CVSS, Apache Camel · org.apache.camel:camel-rabbitmq)
- [CVE-2020-11973](https://cve.now/CVE-2020-11973.md): Apache Camel Netty enables Java deserialization by default. (no CVSS, Apache Camel · org.apache.camel:camel-netty)
- [CVE-2019-13023](https://cve.now/CVE-2019-13023.md): An issue was discovered in all versions of Bond JetSelect. (no CVSS)
- [CVE-2020-11971](https://cve.now/CVE-2020-11971.md): Apache Camel's JMX is vulnerable to Rebind Flaw. (no CVSS, Apache Camel · org.apache.camel:camel +2)
- [CVE-2019-13022](https://cve.now/CVE-2019-13022.md): Bond JetSelect (all versions) has an issue in the Java class (ENCtool.jar) and corresponding password generation algorithm (used to set init (no CVSS)
- [CVE-2019-13021](https://cve.now/CVE-2019-13021.md): The administrative passwords for all versions of Bond JetSelect are stored within an unprotected file on the filesystem, rather than encrypt (no CVSS)
- [CVE-2019-17562](https://cve.now/CVE-2019-17562.md): A buffer overflow vulnerability has been found in the baremetal component of Apache CloudStack. (no CVSS, Apache CloudStack)
- [CVE-2019-17572](https://cve.now/CVE-2019-17572.md): In Apache RocketMQ 4.2.0 to 4.6.0, when the automatic topic creation in the broker is turned on by default, an evil topic like “../../../../ (no CVSS, Apache RocketMQ · org.apache.rocketmq:rocketmq-broker)
- [CVE-2020-1960](https://cve.now/CVE-2020-1960.md): A vulnerability in Apache Flink (1.1.0 to 1.1.5, 1.2.0 to 1.2.1, 1.3.0 to 1.3.3, 1.4.0 to 1.4.2, 1.5.0 to 1.5.6, 1.6.0 to 1.6.4, 1.7.0 to 1. (no CVSS, Apache Flink · org.apache.flink:flink-core)
- [CVE-2020-1945](https://cve.now/CVE-2020-1945.md): Apache Ant 1.1 to 1.9.14 and 1.10.0 to 1.10.7 uses the default temporary directory identified by the Java system property java.io.tmpdir for (no CVSS, Apache Ant · org.apache.ant:ant)
- [CVE-2020-10626](https://cve.now/CVE-2020-10626.md): In Fazecast jSerialComm, Version 2.2.2 and prior, an uncontrolled search path element vulnerability could allow a malicious DLL file with th (no CVSS, Fazecast jSerialComm,)
- [CVE-2020-4468](https://cve.now/CVE-2020-4468.md): IBM i2 Intelligent Analyis Platform 9.2.1 could allow a remote attacker to execute arbitrary code on the system, caused by memory corruption (CVSS 7.8, IBM i2 Analysts Notebook)
- [CVE-2020-4467](https://cve.now/CVE-2020-4467.md): IBM i2 Intelligent Analyis Platform 9.2.1 could allow a remote attacker to execute arbitrary code on the system, caused by memory corruption (CVSS 7.8, IBM i2 Analysts Notebook)
- [CVE-2020-4422](https://cve.now/CVE-2020-4422.md): IBM i2 Intelligent Analyis Platform 9.2.1 could allow a remote attacker to execute arbitrary code on the system, caused by a memory corrupti (CVSS 7.8, IBM i2 Analysts Notebook)
- [CVE-2020-4365](https://cve.now/CVE-2020-4365.md): IBM WebSphere Application Server 8.5 is vulnerable to server-side request forgery. (CVSS 5.3, IBM WebSphere Application Server)
- [CVE-2020-4343](https://cve.now/CVE-2020-4343.md): IBM i2 Intelligent Analyis Platform 9.2.1 could allow a remote attacker to execute arbitrary code on the system, caused by a memory corrupti (CVSS 7.8, IBM i2 Analysts Notebook)
- [CVE-2020-4299](https://cve.now/CVE-2020-4299.md): IBM Sterling B2B Integrator Standard Edition 5.2.0.0 through 6.0.3.1 could expose sensitive information to a user through a specially crafte (CVSS 4.3, IBM Sterling B2B Integrator)
- [CVE-2020-4288](https://cve.now/CVE-2020-4288.md): IBM i2 Intelligent Analyis Platform 9.2.1 could allow a remote attacker to execute arbitrary code on the system, caused by a memory corrupti (CVSS 7.8, IBM i2 Analysts Notebook)
- [CVE-2020-4287](https://cve.now/CVE-2020-4287.md): IBM i2 Intelligent Analyis Platform 9.2.1 could allow a remote attacker to execute arbitrary code on the system, caused by a memory corrupti (CVSS 7.8, IBM i2 Analysts Notebook)
- [CVE-2020-4285](https://cve.now/CVE-2020-4285.md): IBM i2 Intelligent Analyis Platform 9.2.1 could allow a remote attacker to execute arbitrary code on the system, caused by a memory corrupti (CVSS 7.8, IBM i2 Analysts Notebook)
- [CVE-2020-4266](https://cve.now/CVE-2020-4266.md): IBM i2 Intelligent Analyis Platform 9.2.1 could allow a local attacker to execute arbitrary code on the system, caused by a memory corruptio (CVSS 7.8, IBM i2 Analysts Notebook)
- [CVE-2020-4265](https://cve.now/CVE-2020-4265.md): IBM i2 Intelligent Analyis Platform 9.2.1 could allow a local attacker to execute arbitrary code on the system, caused by a memory corruptio (CVSS 7.8, IBM i2 Analysts Notebook)
- [CVE-2020-4264](https://cve.now/CVE-2020-4264.md): IBM i2 Intelligent Analyis Platform 9.2.1 could allow a local attacker to execute arbitrary code on the system, caused by a memory corruptio (CVSS 7.8, IBM i2 Analysts Notebook)
- [CVE-2020-4263](https://cve.now/CVE-2020-4263.md): IBM i2 Intelligent Analyis Platform 9.2.1 could allow a local attacker to execute arbitrary code on the system, caused by a memory corruptio (CVSS 7.8, IBM i2 Analysts Notebook)
- [CVE-2020-4262](https://cve.now/CVE-2020-4262.md): IBM i2 Intelligent Analyis Platform 9.2.1 could allow a local attacker to execute arbitrary code on the system, caused by a memory corruptio (CVSS 7.8, IBM i2 Analysts Notebook)
- [CVE-2020-4261](https://cve.now/CVE-2020-4261.md): IBM i2 Intelligent Analyis Platform 9.2.1 could allow a local attacker to execute arbitrary code on the system, caused by a memory corruptio (CVSS 7.8, IBM i2 Analysts Notebook)
- [CVE-2020-4259](https://cve.now/CVE-2020-4259.md): IBM Sterling File Gateway 2.2.0.0 through 6.0.3.1 could allow an authenticated user could manipulate cookie information and remove or add mo (CVSS 6.5, IBM Sterling File Gateway)
- [CVE-2020-4258](https://cve.now/CVE-2020-4258.md): IBM i2 Intelligent Analyis Platform 9.2.1 could allow a local attacker to execute arbitrary code on the system, caused by a memory corruptio (CVSS 7.8, IBM i2 Analysts Notebook)
- [CVE-2020-4257](https://cve.now/CVE-2020-4257.md): IBM i2 Intelligent Analyis Platform 9.2.1 could allow a local attacker to execute arbitrary code on the system, caused by a memory corruptio (CVSS 7.8, IBM i2 Analysts Notebook)
- [CVE-2019-15083](https://cve.now/CVE-2019-15083.md): Default installations of Zoho ManageEngine ServiceDesk Plus 10.0 before 10500 are vulnerable to XSS injected by a workstation local administ (no CVSS)
- [CVE-2020-12717](https://cve.now/CVE-2020-12717.md): The COVIDSafe (Australia) app 1.0 and 1.1 for iOS allows a remote attacker to crash the app, and consequently interfere with COVID-19 contac (no CVSS)
- [CVE-2020-5576](https://cve.now/CVE-2020-5576.md): Cross-site request forgery (CSRF) vulnerability in Movable Type series (Movable Type 7 r.4606 (7.2.1) and earlier (Movable Type 7), Movable (no CVSS, Six Apart Movable Type)
- [CVE-2020-5577](https://cve.now/CVE-2020-5577.md): Movable Type series (Movable Type 7 r.4606 (7.2.1) and earlier (Movable Type 7), Movable Type Advanced 7 r.4606 (7.2.1) and earlier (Movable (no CVSS, Six Apart Movable Type)
- [CVE-2020-5574](https://cve.now/CVE-2020-5574.md): HTML attribute value injection vulnerability in Movable Type series (Movable Type 7 r.4606 (7.2.1) and earlier (Movable Type 7), Movable Typ (no CVSS, Six Apart Movable Type)
- [CVE-2020-5575](https://cve.now/CVE-2020-5575.md): Cross-site scripting vulnerability in Movable Type series (Movable Type 7 r.4606 (7.2.1) and earlier (Movable Type 7), Movable Type Advanced (no CVSS, Six Apart Movable Type)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2020-05-14
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.