# CVEs published 2020-05-24

8 CVEs were published on May 24, 2020: 0 critical, 0 high. Days are UTC.

- [CVE-2020-13438](https://cve.now/CVE-2020-13438.md): ffjpeg through 2020-02-24 has an invalid read in jfif\_encode in jfif.c. (no CVSS)
- [CVE-2020-13440](https://cve.now/CVE-2020-13440.md): ffjpeg through 2020-02-24 has an invalid write in bmp\_load in bmp.c. (no CVSS)
- [CVE-2020-13439](https://cve.now/CVE-2020-13439.md): ffjpeg through 2020-02-24 has a heap-based buffer over-read in jfif\_decode in jfif.c. (no CVSS)
- [CVE-2020-13434](https://cve.now/CVE-2020-13434.md): SQLite through 3.32.0 has an integer overflow in sqlite3\_str\_vappendf in printf.c. (no CVSS, sqlite)
- [CVE-2020-13435](https://cve.now/CVE-2020-13435.md): SQLite through 3.32.0 has a segmentation fault in sqlite3ExprCodeTarget in expr.c. (no CVSS, sqlite)
- [CVE-2020-13433](https://cve.now/CVE-2020-13433.md): Jason2605 AdminPanel 4.0 allows SQL Injection via the editPlayer.php hidden parameter. (no CVSS)
- [CVE-2020-13429](https://cve.now/CVE-2020-13429.md): legend.ts in the piechart-panel (aka Pie Chart Panel) plugin before 1.5.0 for Grafana allows XSS via the Values Header (aka legend header) o (no CVSS)
- [CVE-2020-13430](https://cve.now/CVE-2020-13430.md): Grafana before 7.0.0 allows tag value XSS via the OpenTSDB datasource. (no CVSS, github.com/grafana/grafana)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2020-05-24
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.