CVEs published May 15, 2020
31 CVEs were published on May 15, 2020: 1 critical, 0 high.
- Published
- 31
- Critical
- 1
- High
- 0
- Medium
- 3
- Low
- 1
- Unrated
- 26
- Now in CISA KEV
- 0
- Fix available
- 8
Most affected products
- intelliants/subrion
- 2
- ALSong Estsoft
- 1
- Bitdefender Engines
- 1
- Canonical pulseaudio
- 1
- Debian apt
- 1
- Honor 20;HONOR 20 PRO;Honor Magic2;HUAWEI Mate 20 X;HUAWEI…
- 1
- logkitty
- 1
- misp-maltego
- 1
- P20
- 1
- pandas
- 1
Critical 1
Medium, low and unrated 30
- CVE-2020-1758A flaw was found in Keycloak in versions before 10.0.0, where it does not perform the TLS hostname verification while sending emails using tRed Hat keycloak · org.keycloak:keycloak-parent
- CVE-2020-13093iSpyConnect.com Agent DVR before 2.7.1.0 allows directory traversal.
- CVE-2020-8149Lack of output sanitization allowed an attack to execute arbitrary shell commands via the logkitty npm package before version 0.7.1.logkitty
- CVE-2020-13091pandas through 1.0.3 can unserialize and execute commands from an untrusted file that is passed to the read_pickle() function, if __reduce__pandas
- CVE-2020-13092scikit-learn (aka sklearn) through 0.23.0 can unserialize and execute commands from an untrusted file that is passed to the joblib.load() fuscikit-learn
- CVE-2020-12872yaws_config.erl in Yaws through 2.0.2 and/or 2.0.7 loads obsolete TLS ciphers, as demonstrated by ones that allow Sweet32 attacks, if runnin
- CVE-2020-12889MISP MISP-maltego 1.4.4 incorrectly shares a MISP connection across users in a remote-transform use case.misp-maltego
- CVE-2020-12798Cellebrite UFED 5.0 to 7.5.0.845 implements local operating system policies that can be circumvented to obtain a command prompt via the Wind
- CVE-2020-12651SecureCRT before 8.7.2 allows remote attackers to execute arbitrary code via an Integer Overflow and a Buffer Overflow because a banner can
- CVE-2019-19721An off-by-one error in the DecodeBlock function in codec/sdl_image.c in VideoLAN VLC media player before 3.0.9 allows remote attackers to ca
- CVE-2019-18666An issue was discovered on D-Link DAP-1360 revision F devices.
- CVE-2019-20390A Cross-Site Request Forgery (CSRF) vulnerability was discovered in Subrion CMS 4.2.1 that allows a remote attacker to remove files on the sintelliants/subrion
- CVE-2019-20389An XSS issue was identified on the Subrion CMS 4.2.1 /panel/configuration/general settings page.intelliants/subrion
- CVE-2020-12888The VFIO PCI driver in the Linux kernel through 5.6.13 mishandles attempts to access disabled memory space.
- CVE-2020-12685XSS in the admin help system admin/help.html and admin/quicklinks.html in Interchange 4.7.0 through 5.11.x allows remote attackers to steal
- CVE-2020-11526libfreerdp/core/update.c in FreeRDP versions > 1.1 through 2.0.0-rc4 has an Out-of-bounds Read.
- CVE-2020-11525libfreerdp/cache/bitmap.c in FreeRDP versions > 1.0 through 2.0.0-rc4 has an Out of bounds read.
- CVE-2020-12834eQ-3 Homematic Central Control Unit (CCU)2 through 2.51.6 and CCU3 through 3.51.6 allow Remote Code Execution in the JSON API Method ReGa.ru
- CVE-2020-11524libfreerdp/codec/interleaved.c in FreeRDP versions > 1.0 through 2.0.0-rc4 has an Out-of-bounds Write.
- CVE-2020-11523libfreerdp/gdi/region.c in FreeRDP versions > 1.0 through 2.0.0-rc4 has an Integer Overflow.
- CVE-2020-11522libfreerdp/gdi/gdi.c in FreeRDP > 1.0 through 2.0.0-rc4 has an Out-of-bounds Read.
- CVE-2020-11521libfreerdp/codec/planar.c in FreeRDP version > 1.0 through 2.0.0-rc4 has an Out-of-bounds Write.
- CVE-2018-10756Use-after-free in libtransmission/variant.c in Transmission before 3.00 allows remote attackers to cause a denial of service (crash) or poss
- CVE-2020-7809Estsoft ALSong DOM-Based XSS VulnerabilityALSong Estsoft
- CVE-2020-9073Huawei P20 smartphones with versions earlier than 10.0.0.156(C00E156R1P4) have an improper authentication vulnerability.P20
- CVE-2020-1808Honor 20;HONOR 20 PRO;Honor Magic2;HUAWEI Mate 20 X;HUAWEI P30;HUAWEI P30 Pro;Honor View 20 smartphones with versions earlier than 10.0.0.18Honor 20;HONOR 20 PRO;Honor Magic2;HUAWEI Mate 20 X;HUAWEI…
- CVE-2020-10744An incomplete fix was found for the fix of the flaw CVE-2020-1733 ansible: insecure temporary directory when running become_user from becomeRed Hat ansible · ansible
- CVE-2020-3810Missing input validation in the ar/tar implementations of APT before version 2.1.2 could result in denial of service when processing specialDebian apt
- CVE-2020-12882Submitty through 20.04.01 allows XSS via upload of an SVG document, as demonstrated by an attack by a Student against a Teaching Fellow.
- CVE-2020-11931Ubuntu modifications to pulseaudio to provide snap security enforcement could be unloadedCanonical pulseaudio