CVEs published May 20, 2020
29 CVEs were published on May 20, 2020: 1 critical, 2 high.
- Published
- 29
- Critical
- 1
- High
- 2
- Medium
- 6
- Low
- 0
- Unrated
- 20
- Now in CISA KEV
- 0
- Fix available
- 7
Most affected products
- [UNKNOWN] dpdk
- 2
- Dell Isilon OneFS
- 2
- dolibarr/dolibarr
- 2
- Apache CouchDB
- 1
- Apache Tomcat · tomcat +2
- 1
- EDS Subsystem, FactoryTalk Linx software (Previously called…
- 1
- github.com/go-gitea/gitea · code.gitea.io/gitea
- 1
- httplib2
- 1
- IBM Security Access Manager Appliance
- 1
- microweber/microweber
- 1
Critical 1
High 2
Medium, low and unrated 26
- CVE-2020-5365Dell EMC Isilon versions 8.2.2 and earlier contain a remotesupport vulnerability.Dell Isilon OneFS
- CVE-2020-5364Dell EMC Isilon OneFS versions 8.2.2 and earlier contain an SNMPv2 vulnerability.Dell Isilon OneFS
- CVE-2020-13241Microweber 1.1.18 allows Unrestricted File Upload because admin/view:modules/load_module:users#edit-user=1 does not verify that the file extmicroweber/microweber
- CVE-2020-13249libmariadb/mariadb_lib.c in MariaDB Connector/C before 3.1.8 does not properly validate the content of an OK packet received from a server.
- CVE-2020-9484When using Apache Tomcat versions 10.0.0-M1 to 10.0.0-M4, 9.0.0.M1 to 9.0.34, 8.5.0 to 8.5.54 and 7.0.0 to 7.0.103 if a) an attacker is ableApache Tomcat · tomcat +2
- CVE-2020-13246An issue was discovered in Gitea through 1.11.5.github.com/go-gitea/gitea · code.gitea.io/gitea
- CVE-2020-11078CRLF injection in httplib2httplib2
- CVE-2020-13239The DMS/ECM module in Dolibarr 11.0.4 renders user-uploaded .html files in the browser when the attachment parameter is removed from the dirdolibarr/dolibarr
- CVE-2020-13240The DMS/ECM module in Dolibarr 11.0.4 allows users with the 'Setup documents directories' permission to rename uploaded files to have insecudolibarr/dolibarr
- CVE-2020-13231In Cacti before 1.2.11, auth_profile.php?action=edit allows CSRF for an admin email change.
- CVE-2020-1955CouchDB version 3.0.0 shipped with a new configuration setting that governs access control to the entire database server called `require_valApache CouchDB
- CVE-2020-13230In Cacti before 1.2.11, disabling a user account does not immediately invalidate any permissions granted to that account (e.g., permission t
- CVE-2020-5753Signal Private Messenger Android v4.59.0 and up and iOS v3.8.1.5 and up allows a remote non-contact to ring a victim's Signal phone and discSignal Private Messenger
- CVE-2020-3956VMware Cloud Director 10.0.x before 10.0.0.2, 9.7.0.x before 9.7.0.5, 9.5.0.x before 9.5.0.6, and 9.1.0.x before 9.1.0.4 do not properly hanVMware Cloud Director
- CVE-2020-11716Panasonic P110, Eluga Z1 Pro, Eluga X1, and Eluga X1 Pro devices through 2020-04-10 have Insecure Permissions.
- CVE-2020-10726A vulnerability was found in DPDK versions 19.11 and above.[UNKNOWN] dpdk
- CVE-2020-12835An issue was discovered in SmartBear ReadyAPI SoapUI Pro 3.2.5.
- CVE-2020-4461IBM Security Access Manager Appliance 9.0.7.1 could allow an authenticated user to bypass security by allowing id_token claims manipulation IBM Security Access Manager Appliance
- CVE-2020-13152A remote user can create a specially crafted M3U file, media playlist file that when loaded by the target user, will trigger a memory leak,
- CVE-2020-13226WSO2 API Manager 3.0.0 does not properly restrict outbound network access from a Publisher node, opening up the possibility of SSRF to this org.wso2.am:am-parent
- CVE-2019-5997Video Insight VMS versions prior to 7.6.1 allow remote attackers to conduct code injection attacks via unspecified vectors.Panasonic Video Insight VMS
- CVE-2020-5579SQL injection vulnerability in the Paid Memberships versions prior to 2.3.3 allows attacker with administrator rights to execute arbitrary SStranger Studios Paid Memberships
- CVE-2019-11048Temporary files are not cleaned after OOM when parsing HTTP request dataPHP Group PHP
- CVE-2020-13225phpIPAM 1.4 contains a stored cross site scripting (XSS) vulnerability within the Edit User Instructions field of the User Instructions widg
- CVE-2020-12034Products that use EDS Subsystem: Version 28.0.1 and prior (FactoryTalk Linx software (Previously called RSLinx Enterprise): Versions 6.00, 6EDS Subsystem, FactoryTalk Linx software (Previously called…
- CVE-2020-9753Whale Browser Installer before 1.2.0.5 versions don't support signature verification for Flash installer.NAVER Whale Browser Installer