# CVEs published 2020-05-15

31 CVEs were published on May 15, 2020: 1 critical, 0 high. Days are UTC.

- [CVE-2020-1758](https://cve.now/CVE-2020-1758.md): A flaw was found in Keycloak in versions before 10.0.0, where it does not perform the TLS hostname verification while sending emails using t (CVSS 5.3, Red Hat keycloak · org.keycloak:keycloak-parent)
- [CVE-2020-13093](https://cve.now/CVE-2020-13093.md): iSpyConnect.com Agent DVR before 2.7.1.0 allows directory traversal. (no CVSS)
- [CVE-2020-8149](https://cve.now/CVE-2020-8149.md): Lack of output sanitization allowed an attack to execute arbitrary shell commands via the logkitty npm package before version 0.7.1. (no CVSS, logkitty)
- [CVE-2020-13091](https://cve.now/CVE-2020-13091.md): pandas through 1.0.3 can unserialize and execute commands from an untrusted file that is passed to the read\_pickle() function, if \_\_reduce\_\_ (no CVSS, pandas)
- [CVE-2020-13092](https://cve.now/CVE-2020-13092.md): scikit-learn (aka sklearn) through 0.23.0 can unserialize and execute commands from an untrusted file that is passed to the joblib.load() fu (no CVSS, scikit-learn)
- [CVE-2020-12872](https://cve.now/CVE-2020-12872.md): yaws\_config.erl in Yaws through 2.0.2 and/or 2.0.7 loads obsolete TLS ciphers, as demonstrated by ones that allow Sweet32 attacks, if runnin (no CVSS)
- [CVE-2020-12889](https://cve.now/CVE-2020-12889.md): MISP MISP-maltego 1.4.4 incorrectly shares a MISP connection across users in a remote-transform use case. (no CVSS, misp-maltego)
- [CVE-2020-12798](https://cve.now/CVE-2020-12798.md): Cellebrite UFED 5.0 to 7.5.0.845 implements local operating system policies that can be circumvented to obtain a command prompt via the Wind (no CVSS)
- [CVE-2020-12651](https://cve.now/CVE-2020-12651.md): SecureCRT before 8.7.2 allows remote attackers to execute arbitrary code via an Integer Overflow and a Buffer Overflow because a banner can (no CVSS)
- [CVE-2019-19721](https://cve.now/CVE-2019-19721.md): An off-by-one error in the DecodeBlock function in codec/sdl\_image.c in VideoLAN VLC media player before 3.0.9 allows remote attackers to ca (no CVSS)
- [CVE-2019-18666](https://cve.now/CVE-2019-18666.md): An issue was discovered on D-Link DAP-1360 revision F devices. (no CVSS)
- [CVE-2019-20390](https://cve.now/CVE-2019-20390.md): A Cross-Site Request Forgery (CSRF) vulnerability was discovered in Subrion CMS 4.2.1 that allows a remote attacker to remove files on the s (no CVSS, intelliants/subrion)
- [CVE-2019-20389](https://cve.now/CVE-2019-20389.md): An XSS issue was identified on the Subrion CMS 4.2.1 /panel/configuration/general settings page. (no CVSS, intelliants/subrion)
- [CVE-2020-12888](https://cve.now/CVE-2020-12888.md): The VFIO PCI driver in the Linux kernel through 5.6.13 mishandles attempts to access disabled memory space. (no CVSS)
- [CVE-2020-12685](https://cve.now/CVE-2020-12685.md): XSS in the admin help system admin/help.html and admin/quicklinks.html in Interchange 4.7.0 through 5.11.x allows remote attackers to steal (no CVSS)
- [CVE-2020-11526](https://cve.now/CVE-2020-11526.md): libfreerdp/core/update.c in FreeRDP versions \> 1.1 through 2.0.0-rc4 has an Out-of-bounds Read. (no CVSS)
- [CVE-2020-11525](https://cve.now/CVE-2020-11525.md): libfreerdp/cache/bitmap.c in FreeRDP versions \> 1.0 through 2.0.0-rc4 has an Out of bounds read. (no CVSS)
- [CVE-2020-12834](https://cve.now/CVE-2020-12834.md): eQ-3 Homematic Central Control Unit (CCU)2 through 2.51.6 and CCU3 through 3.51.6 allow Remote Code Execution in the JSON API Method ReGa.ru (no CVSS)
- [CVE-2020-11524](https://cve.now/CVE-2020-11524.md): libfreerdp/codec/interleaved.c in FreeRDP versions \> 1.0 through 2.0.0-rc4 has an Out-of-bounds Write. (no CVSS)
- [CVE-2020-11523](https://cve.now/CVE-2020-11523.md): libfreerdp/gdi/region.c in FreeRDP versions \> 1.0 through 2.0.0-rc4 has an Integer Overflow. (no CVSS)
- [CVE-2020-11522](https://cve.now/CVE-2020-11522.md): libfreerdp/gdi/gdi.c in FreeRDP \> 1.0 through 2.0.0-rc4 has an Out-of-bounds Read. (no CVSS)
- [CVE-2020-11521](https://cve.now/CVE-2020-11521.md): libfreerdp/codec/planar.c in FreeRDP version \> 1.0 through 2.0.0-rc4 has an Out-of-bounds Write. (no CVSS)
- [CVE-2018-10756](https://cve.now/CVE-2018-10756.md): Use-after-free in libtransmission/variant.c in Transmission before 3.00 allows remote attackers to cause a denial of service (crash) or poss (no CVSS)
- [CVE-2020-7809](https://cve.now/CVE-2020-7809.md): Estsoft ALSong DOM-Based XSS Vulnerability (CVSS 4.4, ALSong Estsoft)
- [CVE-2020-9073](https://cve.now/CVE-2020-9073.md): Huawei P20 smartphones with versions earlier than 10.0.0.156(C00E156R1P4) have an improper authentication vulnerability. (no CVSS, P20)
- [CVE-2020-1808](https://cve.now/CVE-2020-1808.md): Honor 20;HONOR 20 PRO;Honor Magic2;HUAWEI Mate 20 X;HUAWEI P30;HUAWEI P30 Pro;Honor View 20 smartphones with versions earlier than 10.0.0.18 (no CVSS, Honor 20;HONOR 20 PRO;Honor Magic2;HUAWEI Mate 20 X;HUAWEI…)
- [CVE-2020-10744](https://cve.now/CVE-2020-10744.md): An incomplete fix was found for the fix of the flaw CVE-2020-1733 ansible: insecure temporary directory when running become\_user from become (CVSS 5.0, Red Hat ansible · ansible)
- [CVE-2020-3810](https://cve.now/CVE-2020-3810.md): Missing input validation in the ar/tar implementations of APT before version 2.1.2 could result in denial of service when processing special (no CVSS, Debian apt)
- [CVE-2020-8100](https://cve.now/CVE-2020-8100.md): Incomplete validation in detection code in Bitdefender Engines (VA-8589) (CVSS 9.0, Bitdefender Engines)
- [CVE-2020-12882](https://cve.now/CVE-2020-12882.md): Submitty through 20.04.01 allows XSS via upload of an SVG document, as demonstrated by an attack by a Student against a Teaching Fellow. (no CVSS)
- [CVE-2020-11931](https://cve.now/CVE-2020-11931.md): Ubuntu modifications to pulseaudio to provide snap security enforcement could be unloaded (CVSS 3.3, Canonical pulseaudio)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2020-05-15
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.