CVEs published May 18, 2020
40 CVEs were published on May 18, 2020: 1 critical, 5 high.
- Published
- 40
- Critical
- 1
- High
- 5
- Medium
- 3
- Low
- 0
- Unrated
- 31
- Now in CISA KEV
- 0
- Fix available
- 3
Most affected products
- Nitro Pro
- 3
- dolibarr/dolibarr
- 1
- Enterprise Server and Enterprise developer.
- 1
- Facebook proxygen
- 1
- The Document Foundation LibreOffice
- 1
Critical 1
High 5
- CVE-2020-6092An exploitable code execution vulnerability exists in the way Nitro Pro 13.9.1.155 parses Pattern objects.Nitro Pro
- CVE-2020-6074An exploitable code execution vulnerability exists in the PDF parser of Nitro Pro 13.9.1.155.Nitro Pro
- CVE-2020-11549An issue was discovered on NETGEAR Orbi Tri-Band Business WiFi Add-on Satellite (SRS60) AC3000 V2.5.1.106, Outdoor Satellite (RBS50Y) V2.5.1
- CVE-2020-11550An issue was discovered on NETGEAR Orbi Tri-Band Business WiFi Add-on Satellite (SRS60) AC3000 V2.5.1.106, Outdoor Satellite (RBS50Y) V2.5.1
- CVE-2020-10957In Dovecot before 2.3.10.1, unauthenticated sending of malformed parameters to a NOOP command causes a NULL Pointer Dereference and crash in
Medium, low and unrated 34
- CVE-2019-17066In Ivanti WorkSpace Control before 10.4.40.0, a user can elevate rights on the system by hijacking certain user registries.
- CVE-2020-13154Zoho ManageEngine Service Plus before 11.1 build 11112 allows low-privilege authenticated users to discover the File Protection password via
- CVE-2020-1897A use-after-free is possible due to an error in lifetime management in the request adaptor when a malicious client invokes request error hanFacebook proxygen
- CVE-2020-13153app/View/Events/resolved_attributes.ctp in MISP before 2.4.126 has XSS in the resolved attributes view.
- CVE-2020-13094Dolibarr before 11.0.4 allows XSS.dolibarr/dolibarr
- CVE-2020-13149Weak permissions on the "%PROGRAMDATA%\MSI\Dragon Center" folder in Dragon Center before 2.6.2003.2401, shipped with Micro-Star MSI Gaming l
- CVE-2020-13145Studio in Open edX Ironwood 2.5 allows users to upload SVG files via the "Content>File Uploads" screen.
- CVE-2020-13146Studio in Open edX Ironwood 2.5 allows CSV injection because an added cohort in Course>Instructor>Cohorts may contain a formula that is expo
- CVE-2020-13144Studio in Open edX Ironwood 2.5, when CodeJail is not used, allows a user to go to the "Create New course>New section>New subsection>New uni
- CVE-2020-13143gadget_dev_desc_UDC_store in drivers/usb/gadget/configfs.c in the Linux kernel 3.16 through 5.6.13 relies on kstrdup without considering the
- CVE-2019-19456A Reflected XSS was found in the server selection box inside the login page at: enginemanager/loginfailed.html in Wowza Streaming Engine <=
- CVE-2019-19454An arbitrary file download was found in the "Download Log" functionality of Wowza Streaming Engine <= 4.x.x.
- CVE-2020-6093An exploitable information disclosure vulnerability exists in the way Nitro Pro 13.9.1.155 does XML error handling.Nitro Pro
- CVE-2020-8034Gollem before 3.0.13, as used in Horde Groupware Webmail Edition 5.2.22 and other products, is affected by a reflected Cross-Site Scripting
- CVE-2020-13135D-Link DSP-W215 1.26b03 devices allow information disclosure by intercepting messages on the local network, as demonstrated by a Squid Proxy
- CVE-2020-13136D-Link DSP-W215 1.26b03 devices send an obfuscated hash that can be retrieved and understood by a network sniffer.
- CVE-2019-7246An issue was discovered in atillk64.sys in AMD ATI Diagnostics Hardware Abstraction Sys/Overclocking Utility 5.11.9.0.
- CVE-2019-7247An issue was discovered in AODDriver2.sys in AMD OverDrive.
- CVE-2020-8035The image view functionality in Horde Groupware Webmail Edition before 5.2.22 is affected by a stored Cross-Site Scripting (XSS) vulnerabili
- CVE-2020-12801Crash-recovered MSOffice encrypted documents defaulted to not to using encryption on next saveThe Document Foundation LibreOffice
- CVE-2020-12255rConfig 3.9.4 is vulnerable to remote code execution due to improper validation in the file upload functionality.
- CVE-2020-12256rConfig 3.9.4 is vulnerable to reflected XSS.
- CVE-2020-10967In Dovecot before 2.3.10.1, remote unauthenticated attackers can crash the lmtp or submission process by sending mail with an empty localpar
- CVE-2020-10958In Dovecot before 2.3.10.1, a crafted SMTP/LMTP message triggers an unauthenticated use-after-free bug in submission-login, submission, or l
- CVE-2020-12257rConfig 3.9.4 is vulnerable to cross-site request forgery (CSRF) because it lacks implementation of CSRF protection such as a CSRF token.
- CVE-2020-9524Cross Site scripting vulnerability on Micro Focus Enterprise Server and Enterprise developer, affecting all versions prior to version 5.0 PaEnterprise Server and Enterprise developer.
- CVE-2020-12258rConfig 3.9.4 is vulnerable to session fixation because session expiry and randomization are mishandled.
- CVE-2020-12259rConfig 3.9.4 is vulnerable to reflected XSS.
- CVE-2020-13129An issue was discovered in the stashcat app through 3.9.1 for macOS, Windows, Android, iOS, and possibly other platforms.
- CVE-2020-12860COVIDSafe through v1.0.17 allows a remote attacker to access phone name and model information because a BLE device can have four roles and C
- CVE-2020-12859Unnecessary fields in the OpenTrace/BlueTrace protocol in COVIDSafe through v1.0.17 allow a remote attacker to identify a device model by ob
- CVE-2020-12858Non-reinitialisation of random data in the advertising payload in COVIDSafe v1.0.15 and v1.0.16 allows a remote attacker to re-identify Andr
- CVE-2020-12857Caching of GATT characteristic values (TempID) in COVIDSafe v1.0.15 and v1.0.16 allows a remote attacker to long-term re-identify an Android
- CVE-2020-12856OpenTrace, as used in COVIDSafe through v1.0.17, TraceTogether, ABTraceTogether, and other applications on iOS and Android, allows remote at