# CVEs published 2020-05-22

32 CVEs were published on May 22, 2020: 2 critical, 4 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2020-13412](https://cve.now/CVE-2020-13412.md): An issue was discovered in Aviatrix Controller before 5.4.1204. (no CVSS)
- [CVE-2020-13413](https://cve.now/CVE-2020-13413.md): An issue was discovered in Aviatrix Controller before 5.4.1204. (no CVSS)
- [CVE-2020-13414](https://cve.now/CVE-2020-13414.md): An issue was discovered in Aviatrix Controller before 5.4.1204. (no CVSS)
- [CVE-2020-13415](https://cve.now/CVE-2020-13415.md): An issue was discovered in Aviatrix Controller through 5.1. (no CVSS)
- [CVE-2020-13416](https://cve.now/CVE-2020-13416.md): An issue was discovered in Aviatrix Controller before 5.4.1066. (no CVSS)
- [CVE-2020-13417](https://cve.now/CVE-2020-13417.md): An Elevation of Privilege issue was discovered in Aviatrix VPN Client before 2.10.7, because of an incomplete fix for CVE-2020-7224. (no CVSS)
- [CVE-2020-12397](https://cve.now/CVE-2020-12397.md): By encoding Unicode whitespace characters within the From email header, an attacker can spoof the sender email address that Thunderbird disp (no CVSS, Mozilla Thunderbird)
- [CVE-2020-13388](https://cve.now/CVE-2020-13388.md): An exploitable vulnerability exists in the configuration-loading functionality of the jw.util package before 2.3 for Python. (no CVSS, jw-util)
- [CVE-2020-13389](https://cve.now/CVE-2020-13389.md): An issue was discovered on Tenda AC6 V1.0 V15.03.05.19\_multi\_TD01, AC9 V1.0 V15.03.05.19(6318)\_CN, AC9 V3.0 V15.03.06.42\_multi, AC15 V1.0 V1 (no CVSS)
- [CVE-2020-13390](https://cve.now/CVE-2020-13390.md): An issue was discovered on Tenda AC6 V1.0 V15.03.05.19\_multi\_TD01, AC9 V1.0 V15.03.05.19(6318)\_CN, AC9 V3.0 V15.03.06.42\_multi, AC15 V1.0 V1 (no CVSS)
- [CVE-2020-13391](https://cve.now/CVE-2020-13391.md): An issue was discovered on Tenda AC6 V1.0 V15.03.05.19\_multi\_TD01, AC9 V1.0 V15.03.05.19(6318)\_CN, AC9 V3.0 V15.03.06.42\_multi, AC15 V1.0 V1 (no CVSS)
- [CVE-2020-13392](https://cve.now/CVE-2020-13392.md): An issue was discovered on Tenda AC6 V1.0 V15.03.05.19\_multi\_TD01, AC9 V1.0 V15.03.05.19(6318)\_CN, AC9 V3.0 V15.03.06.42\_multi, AC15 V1.0 V1 (no CVSS)
- [CVE-2020-13393](https://cve.now/CVE-2020-13393.md): An issue was discovered on Tenda AC6 V1.0 V15.03.05.19\_multi\_TD01, AC9 V1.0 V15.03.05.19(6318)\_CN, AC9 V3.0 V15.03.06.42\_multi, AC15 V1.0 V1 (no CVSS)
- [CVE-2020-13394](https://cve.now/CVE-2020-13394.md): An issue was discovered on Tenda AC6 V1.0 V15.03.05.19\_multi\_TD01, AC9 V1.0 V15.03.05.19(6318)\_CN, AC9 V3.0 V15.03.06.42\_multi, AC15 V1.0 V1 (no CVSS)
- [CVE-2020-7658](https://cve.now/CVE-2020-7658.md): meinheld prior to 1.0.2 is vulnerable to HTTP Request Smuggling. (no CVSS, meinheld)
- [CVE-2020-11077](https://cve.now/CVE-2020-11077.md): HTTP Smuggling via Transfer-Encoding Header in Puma (CVSS 6.8, puma)
- [CVE-2020-11076](https://cve.now/CVE-2020-11076.md): HTTP Smuggling via Transfer-Encoding Header in Puma (CVSS 7.5, puma)
- [CVE-2020-10711](https://cve.now/CVE-2020-10711.md): A NULL pointer dereference flaw was found in the Linux kernel's SELinux subsystem in versions before 5.7. (CVSS 5.9, Red Hat Kernel)
- [CVE-2020-6091](https://cve.now/CVE-2020-6091.md): An exploitable authentication bypass vulnerability exists in the ESPON Web Control functionality of Epson EB-1470Ui MAIN: 98009273ESWWV107 M (CVSS 9.8, Epson)
- [CVE-2020-1956](https://cve.now/CVE-2020-1956.md): Apache Kylin 2.3.0, and releases up to 2.6.5 and 3.0.1 has some restful apis which will concatenate os command with the user input string, a (CVSS 8.8, KEV, Apache Kylin · org.apache.kylin:kylin-core-common)
- [CVE-2020-8789](https://cve.now/CVE-2020-8789.md): Composr 10.0.30 allows Persistent XSS via a Usergroup name under the Security configuration. (no CVSS)
- [CVE-2020-7813](https://cve.now/CVE-2020-7813.md): Kaoni ezHTTPTrans Active-X File Download and Execution Vulnerability (CVSS 7.8, Kaoni ezHTTPTrans)
- [CVE-2020-3280](https://cve.now/CVE-2020-3280.md): Cisco Unified Contact Center Express Remote Code Execution Vulnerability (CVSS 9.8, Cisco Unified Contact Center Express)
- [CVE-2020-3184](https://cve.now/CVE-2020-3184.md): Cisco Prime Collaboration Provisioning Software SQL Injection Vulnerability (CVSS 6.7, Cisco Prime Collaboration Provisioning)
- [CVE-2020-3272](https://cve.now/CVE-2020-3272.md): Cisco Prime Network Registrar DHCP Denial of Service Vulnerability (CVSS 7.5, Cisco Prime Network Registrar)
- [CVE-2020-3314](https://cve.now/CVE-2020-3314.md): Cisco AMP for Endpoints Mac Connector Software File Scan Denial of Service Vulnerability (CVSS 6.1, Cisco AMP for Endpoints)
- [CVE-2020-3343](https://cve.now/CVE-2020-3343.md): Cisco AMP for Endpoints Linux Connector and AMP for Endpoints Mac Connector Software Memory Buffer Vulnerability (CVSS 5.5, Cisco AMP for Endpoints)
- [CVE-2020-3344](https://cve.now/CVE-2020-3344.md): Cisco AMP for Endpoints Linux Connector and AMP for Endpoints Mac Connector Software Memory Buffer Vulnerability (CVSS 5.5, Cisco AMP for Endpoints)
- [CVE-2020-13384](https://cve.now/CVE-2020-13384.md): Monstra CMS 3.0.4 allows remote authenticated users to upload and execute arbitrary PHP code via admin/index.php?id=filesmanager because, fo (no CVSS)
- [CVE-2020-13396](https://cve.now/CVE-2020-13396.md): An issue was discovered in FreeRDP before 2.1.1. (no CVSS)
- [CVE-2020-13397](https://cve.now/CVE-2020-13397.md): An issue was discovered in FreeRDP before 2.1.1. (no CVSS)
- [CVE-2020-13398](https://cve.now/CVE-2020-13398.md): An issue was discovered in FreeRDP before 2.1.1. (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2020-05-22
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.