# CVEs published 2020-05-19

36 CVEs were published on May 19, 2020: 0 critical, 6 high. Days are UTC.

- [CVE-2020-7138](https://cve.now/CVE-2020-7138.md): Potential remote code execution security vulnerabilities have been identified with HPE Nimble Storage systems that could be exploited by an (no CVSS, HPE Nimble Storage Hybrid Flash Arrays; Nimble Storage All…)
- [CVE-2020-7139](https://cve.now/CVE-2020-7139.md): Potential remote access security vulnerabilities have been identified with HPE Nimble Storage systems that could be exploited by an attacker (no CVSS, HPE Nimble Storage Hybrid Flash Arrays; Nimble Storage All…)
- [CVE-2020-7137](https://cve.now/CVE-2020-7137.md): A validation issue in HPE Superdome Flex's RMC component may allow local elevation of privilege. (no CVSS, HPE Superdome Flex Server)
- [CVE-2020-12038](https://cve.now/CVE-2020-12038.md): Products that use EDS Subsystem: Version 28.0.1 and prior (FactoryTalk Linx software (Previously called RSLinx Enterprise): Versions 6.00, 6 (no CVSS, EDS Subsystem, FactoryTalk Linx software (Previously called…)
- [CVE-2020-13164](https://cve.now/CVE-2020-13164.md): In Wireshark 3.2.0 to 3.2.3, 3.0.0 to 3.0.10, and 2.6.0 to 2.6.16, the NFS dissector could crash. (no CVSS)
- [CVE-2020-13163](https://cve.now/CVE-2020-13163.md): em-imap 0.5 uses the library eventmachine in an insecure way that allows an attacker to perform a man-in-the-middle attack against users of (no CVSS, em-imap)
- [CVE-2020-2025](https://cve.now/CVE-2020-2025.md): Kata Containers - Cloud Hypervisor guests persist filesystem changes to the underlying host image file (CVSS 8.8, Kata Containers)
- [CVE-2020-2024](https://cve.now/CVE-2020-2024.md): Kata Containers - Guests can trick the kata-runtime into unmounting any mount point on the host (CVSS 6.5, Kata Containers)
- [CVE-2020-13166](https://cve.now/CVE-2020-13166.md): The management tool in MyLittleAdmin 3.8 allows remote attackers to execute arbitrary code because machineKey is hardcoded (the same for all (no CVSS)
- [CVE-2020-13167](https://cve.now/CVE-2020-13167.md): Netsweeper through 6.4.3 allows unauthenticated remote code execution because webadmin/tools/unixlogin.php (with certain Referer headers) la (no CVSS)
- [CVE-2020-11766](https://cve.now/CVE-2020-11766.md): sendfax.php in iFAX AvantFAX before 3.3.6 and HylaFAX Enterprise Web Interface before 0.2.5 allows authenticated Command Injection. (no CVSS)
- [CVE-2020-10722](https://cve.now/CVE-2020-10722.md): A vulnerability was found in DPDK versions 18.05 and above. (CVSS 5.1, \[UNKNOWN\] dpdk)
- [CVE-2020-10723](https://cve.now/CVE-2020-10723.md): A memory corruption issue was found in DPDK versions 17.05 and above. (CVSS 5.1, \[UNKNOWN\] dpdk)
- [CVE-2020-10724](https://cve.now/CVE-2020-10724.md): A vulnerability was found in DPDK versions 18.11 and above. (CVSS 5.1, \[UNKNOWN\] dpdk)
- [CVE-2020-11715](https://cve.now/CVE-2020-11715.md): Panasonic P99 devices through 2020-04-10 have Incorrect Access Control. (no CVSS)
- [CVE-2020-10995](https://cve.now/CVE-2020-10995.md): PowerDNS Recursor from 4.1.0 up to and including 4.3.0 does not sufficiently defend against amplification attacks. (no CVSS)
- [CVE-2020-11807](https://cve.now/CVE-2020-11807.md): Because of Unrestricted Upload of a File with a Dangerous Type, Sourcefabric Newscoop 4.4.7 allows an authenticated user to execute arbitrar (no CVSS)
- [CVE-2020-10030](https://cve.now/CVE-2020-10030.md): An issue has been found in PowerDNS Recursor 4.1.0 up to and including 4.3.0. (no CVSS)
- [CVE-2020-10134](https://cve.now/CVE-2020-10134.md): Bluetooth devices supporting LE and specific BR/EDR implementations are vulnerable to method confusion attacks (CVSS 6.3, Bluetooth LE)
- [CVE-2020-10135](https://cve.now/CVE-2020-10135.md): Bluetooth devices supporting BR/EDR v5.2 and earlier are vulnerable to impersonation attacks (CVSS 5.4, Bluetooth BR/EDR)
- [CVE-2020-8021](https://cve.now/CVE-2020-8021.md): unauthorized read access to files where sourceaccess is disabled via a crafted \_service file in Open Build Service (CVSS 5.3, openSUSE Open Build Service)
- [CVE-2020-1695](https://cve.now/CVE-2020-1695.md): A flaw was found in all resteasy 3.x.x versions prior to 3.12.0.Final and all resteasy 4.x.x versions prior to 4.6.0.Final, where an imprope (CVSS 7.5, Red Hat resteasy · org.jboss.resteasy:resteasy-client)
- [CVE-2020-11845](https://cve.now/CVE-2020-11845.md): Cross Site Scripting vulnerability in Micro Focus Service Manager product. (no CVSS, Service Manager.)
- [CVE-2020-8617](https://cve.now/CVE-2020-8617.md): A logic error in code which checks TSIG validity can be used to trigger an assertion failure in tsig.c (CVSS 7.5, ISC BIND9)
- [CVE-2020-8616](https://cve.now/CVE-2020-8616.md): BIND does not sufficiently limit the number of fetches performed when processing referrals (CVSS 8.6, ISC BIND9)
- [CVE-2020-12244](https://cve.now/CVE-2020-12244.md): An issue has been found in PowerDNS Recursor 4.1.0 through 4.3.0 where records in the answer section of a NXDOMAIN response lacking an SOA w (no CVSS)
- [CVE-2020-12662](https://cve.now/CVE-2020-12662.md): Unbound before 1.10.1 has Insufficient Control of Network Message Volume, aka an "NXNSAttack" issue. (no CVSS)
- [CVE-2020-12663](https://cve.now/CVE-2020-12663.md): Unbound before 1.10.1 has an infinite loop via malformed DNS answers received from upstream servers. (no CVSS)
- [CVE-2020-4412](https://cve.now/CVE-2020-4412.md): The Spectrum Scale 4.2.0.0 through 4.2.3.21 and 5.0.0.0 through 5.0.4.3 file system component is affected by a denial of service security vu (CVSS 5.3, IBM Spectrum Scale)
- [CVE-2020-4411](https://cve.now/CVE-2020-4411.md): The Spectrum Scale 4.2.0.0 through 4.2.3.21 and 5.0.0.0 through 5.0.4.3 file system component is affected by a denial of service vulnerabili (CVSS 7.1, IBM Spectrum Scale)
- [CVE-2020-4298](https://cve.now/CVE-2020-4298.md): IBM InfoSphere Information Server 11.3, 11.5, and 11.7 is vulnerable to cross-site scripting. (CVSS 5.4, IBM InfoSphere Information Server)
- [CVE-2020-4286](https://cve.now/CVE-2020-4286.md): IBM InfoSphere Information Server 11.3, 11.5, and 11.7 is vulnerable to cross-site request forgery which could allow an attacker to execute (CVSS 4.3, IBM InfoSphere Information Server)
- [CVE-2020-6956](https://cve.now/CVE-2020-6956.md): PCS DEXICON 3.4.1 allows XSS via the loginName parameter in login\_action.jsp. (no CVSS)
- [CVE-2020-8434](https://cve.now/CVE-2020-8434.md): Jenzabar JICS (aka Internet Campus Solution) before 9.0.1 Patch 3, 9.1 before 9.1.2 Patch 2, and 9.2 before 9.2.2 Patch 8 has session cookie (no CVSS)
- [CVE-2020-12667](https://cve.now/CVE-2020-12667.md): Knot Resolver before 5.1.1 allows traffic amplification via a crafted DNS answer from an attacker-controlled server, aka an "NXNSAttack" iss (CVSS 7.5)
- [CVE-2020-7656](https://cve.now/CVE-2020-7656.md): jquery prior to 1.9.0 allows Cross-site Scripting attacks via the load method. (no CVSS, jquery · jquery-rails +1)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2020-05-19
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.