# CVEs published 2020-05-20

29 CVEs were published on May 20, 2020: 1 critical, 2 high. Days are UTC.

- [CVE-2020-5365](https://cve.now/CVE-2020-5365.md): Dell EMC Isilon versions 8.2.2 and earlier contain a remotesupport vulnerability. (CVSS 5.3, Dell Isilon OneFS)
- [CVE-2020-5364](https://cve.now/CVE-2020-5364.md): Dell EMC Isilon OneFS versions 8.2.2 and earlier contain an SNMPv2 vulnerability. (CVSS 5.3, Dell Isilon OneFS)
- [CVE-2020-13241](https://cve.now/CVE-2020-13241.md): Microweber 1.1.18 allows Unrestricted File Upload because admin/view:modules/load\_module:users#edit-user=1 does not verify that the file ext (no CVSS, microweber/microweber)
- [CVE-2020-13249](https://cve.now/CVE-2020-13249.md): libmariadb/mariadb\_lib.c in MariaDB Connector/C before 3.1.8 does not properly validate the content of an OK packet received from a server. (no CVSS)
- [CVE-2020-9484](https://cve.now/CVE-2020-9484.md): When using Apache Tomcat versions 10.0.0-M1 to 10.0.0-M4, 9.0.0.M1 to 9.0.34, 8.5.0 to 8.5.54 and 7.0.0 to 7.0.103 if a) an attacker is able (no CVSS, Apache Tomcat · tomcat +2)
- [CVE-2020-13246](https://cve.now/CVE-2020-13246.md): An issue was discovered in Gitea through 1.11.5. (no CVSS, github.com/go-gitea/gitea · code.gitea.io/gitea)
- [CVE-2020-11078](https://cve.now/CVE-2020-11078.md): CRLF injection in httplib2 (CVSS 6.8, httplib2)
- [CVE-2020-13239](https://cve.now/CVE-2020-13239.md): The DMS/ECM module in Dolibarr 11.0.4 renders user-uploaded .html files in the browser when the attachment parameter is removed from the dir (no CVSS, dolibarr/dolibarr)
- [CVE-2020-13240](https://cve.now/CVE-2020-13240.md): The DMS/ECM module in Dolibarr 11.0.4 allows users with the 'Setup documents directories' permission to rename uploaded files to have insecu (no CVSS, dolibarr/dolibarr)
- [CVE-2020-13231](https://cve.now/CVE-2020-13231.md): In Cacti before 1.2.11, auth\_profile.php?action=edit allows CSRF for an admin email change. (no CVSS)
- [CVE-2020-1955](https://cve.now/CVE-2020-1955.md): CouchDB version 3.0.0 shipped with a new configuration setting that governs access control to the entire database server called \`require\_val (no CVSS, Apache CouchDB)
- [CVE-2020-13230](https://cve.now/CVE-2020-13230.md): In Cacti before 1.2.11, disabling a user account does not immediately invalidate any permissions granted to that account (e.g., permission t (no CVSS)
- [CVE-2020-5753](https://cve.now/CVE-2020-5753.md): Signal Private Messenger Android v4.59.0 and up and iOS v3.8.1.5 and up allows a remote non-contact to ring a victim's Signal phone and disc (no CVSS, Signal Private Messenger)
- [CVE-2020-3956](https://cve.now/CVE-2020-3956.md): VMware Cloud Director 10.0.x before 10.0.0.2, 9.7.0.x before 9.7.0.5, 9.5.0.x before 9.5.0.6, and 9.1.0.x before 9.1.0.4 do not properly han (no CVSS, VMware Cloud Director)
- [CVE-2020-10725](https://cve.now/CVE-2020-10725.md): A flaw was found in DPDK version 19.11 and above that allows a malicious guest to cause a segmentation fault of the vhost-user backend appli (CVSS 7.7, \[UNKNOWN\] dpdk)
- [CVE-2020-11716](https://cve.now/CVE-2020-11716.md): Panasonic P110, Eluga Z1 Pro, Eluga X1, and Eluga X1 Pro devices through 2020-04-10 have Insecure Permissions. (no CVSS)
- [CVE-2020-10726](https://cve.now/CVE-2020-10726.md): A vulnerability was found in DPDK versions 19.11 and above. (CVSS 6.0, \[UNKNOWN\] dpdk)
- [CVE-2020-12835](https://cve.now/CVE-2020-12835.md): An issue was discovered in SmartBear ReadyAPI SoapUI Pro 3.2.5. (no CVSS)
- [CVE-2020-4461](https://cve.now/CVE-2020-4461.md): IBM Security Access Manager Appliance 9.0.7.1 could allow an authenticated user to bypass security by allowing id\_token claims manipulation (CVSS 6.5, IBM Security Access Manager Appliance)
- [CVE-2020-13152](https://cve.now/CVE-2020-13152.md): A remote user can create a specially crafted M3U file, media playlist file that when loaded by the target user, will trigger a memory leak, (no CVSS)
- [CVE-2020-9410](https://cve.now/CVE-2020-9410.md): TIBCO JasperReports Library (CVSS 7.3, TIBCO Software TIBCO JasperReports Library · TIBCO Software…)
- [CVE-2020-9409](https://cve.now/CVE-2020-9409.md): TIBCO JasperReports Server Fails To Enforce Access Restrictions (CVSS 9.8, TIBCO Software TIBCO JasperReports Server)
- [CVE-2020-13226](https://cve.now/CVE-2020-13226.md): WSO2 API Manager 3.0.0 does not properly restrict outbound network access from a Publisher node, opening up the possibility of SSRF to this (no CVSS, org.wso2.am:am-parent)
- [CVE-2019-5997](https://cve.now/CVE-2019-5997.md): Video Insight VMS versions prior to 7.6.1 allow remote attackers to conduct code injection attacks via unspecified vectors. (no CVSS, Panasonic Video Insight VMS)
- [CVE-2020-5579](https://cve.now/CVE-2020-5579.md): SQL injection vulnerability in the Paid Memberships versions prior to 2.3.3 allows attacker with administrator rights to execute arbitrary S (no CVSS, Stranger Studios Paid Memberships)
- [CVE-2019-11048](https://cve.now/CVE-2019-11048.md): Temporary files are not cleaned after OOM when parsing HTTP request data (CVSS 5.3, PHP Group PHP)
- [CVE-2020-13225](https://cve.now/CVE-2020-13225.md): phpIPAM 1.4 contains a stored cross site scripting (XSS) vulnerability within the Edit User Instructions field of the User Instructions widg (no CVSS)
- [CVE-2020-12034](https://cve.now/CVE-2020-12034.md): Products that use EDS Subsystem: Version 28.0.1 and prior (FactoryTalk Linx software (Previously called RSLinx Enterprise): Versions 6.00, 6 (no CVSS, EDS Subsystem, FactoryTalk Linx software (Previously called…)
- [CVE-2020-9753](https://cve.now/CVE-2020-9753.md): Whale Browser Installer before 1.2.0.5 versions don't support signature verification for Flash installer. (no CVSS, NAVER Whale Browser Installer)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2020-05-20
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.