# CVEs published 2020-05-26 26 CVEs were published on May 26, 2020: 0 critical, 1 high. Days are UTC. - [CVE-2020-13622](https://cve.now/CVE-2020-13622.md): JerryScript 2.2.0 allows attackers to cause a denial of service (assertion failure) because a property key query for a Proxy object returns (no CVSS) - [CVE-2020-13623](https://cve.now/CVE-2020-13623.md): JerryScript 2.2.0 allows attackers to cause a denial of service (stack consumption) via a proxy operation. (no CVSS) - [CVE-2020-13614](https://cve.now/CVE-2020-13614.md): An issue was discovered in ssl.c in Axel before 2.17.8. (no CVSS) - [CVE-2020-13615](https://cve.now/CVE-2020-13615.md): lib/QoreSocket.cpp in Qore before 0.9.4.2 lacks hostname verification for X.509 certificates. (no CVSS) - [CVE-2020-13616](https://cve.now/CVE-2020-13616.md): The boost ASIO wrapper in net/asio.cpp in Pichi before 1.3.0 lacks TLS hostname verification. (no CVSS) - [CVE-2020-9046](https://cve.now/CVE-2020-9046.md): Kantech EntraPass Security Management Software - System Permissions Vulnerability (CVSS 8.8, Johnson Controls Kantech EntraPass Security Management S… +1) - [CVE-2020-6830](https://cve.now/CVE-2020-6830.md): For native-to-JS bridging, the app requires a unique token to be passed that ensures non-app code can't call the bridging functions. (no CVSS, Mozilla Firefox for iOS) - [CVE-2020-6831](https://cve.now/CVE-2020-6831.md): A buffer overflow could occur when parsing and validating SCTP chunks in WebRTC. (no CVSS, Mozilla Firefox ESR · Mozilla Firefox +1) - [CVE-2020-12387](https://cve.now/CVE-2020-12387.md): A race condition when running shutdown code for Web Worker led to a use-after-free vulnerability. (no CVSS, Mozilla Firefox ESR · Mozilla Firefox +1) - [CVE-2020-12388](https://cve.now/CVE-2020-12388.md): The Firefox content processes did not sufficiently lockdown access control which could result in a sandbox escape. (no CVSS, Mozilla Firefox ESR · Mozilla Firefox) - [CVE-2020-12389](https://cve.now/CVE-2020-12389.md): The Firefox content processes did not sufficiently lockdown access control which could result in a sandbox escape. (no CVSS, Mozilla Firefox ESR · Mozilla Firefox) - [CVE-2020-12390](https://cve.now/CVE-2020-12390.md): Incorrect origin serialization of URLs with IPv6 addresses could lead to incorrect security checks. (no CVSS, Mozilla Firefox) - [CVE-2020-12391](https://cve.now/CVE-2020-12391.md): Documents formed using data: URLs in an OBJECT element failed to inherit the CSP of the creating context. (no CVSS, Mozilla Firefox) - [CVE-2020-12392](https://cve.now/CVE-2020-12392.md): The 'Copy as cURL' feature of Devtools' network tab did not properly escape the HTTP POST data of a request, which can be controlled by the (no CVSS, Mozilla Firefox ESR · Mozilla Firefox +1) - [CVE-2020-12393](https://cve.now/CVE-2020-12393.md): The 'Copy as cURL' feature of Devtools' network tab did not properly escape the HTTP method of a request, which can be controlled by the web (no CVSS, Mozilla Firefox ESR · Mozilla Firefox +1) - [CVE-2020-12394](https://cve.now/CVE-2020-12394.md): A logic flaw in our location bar implementation could have allowed a local attacker to spoof the current location by selecting a different o (no CVSS, Mozilla Firefox) - [CVE-2020-12395](https://cve.now/CVE-2020-12395.md): Mozilla developers and community members reported memory safety bugs present in Firefox 75 and Firefox ESR 68.7. (no CVSS, Mozilla Firefox ESR · Mozilla Firefox +1) - [CVE-2020-12396](https://cve.now/CVE-2020-12396.md): Mozilla developers and community members reported memory safety bugs present in Firefox 75. (no CVSS, Mozilla Firefox) - [CVE-2020-8168](https://cve.now/CVE-2020-8168.md): We have recently released new version of AirMax AirOS firmware v6.3.0 for TI, XW and XM boards that fixes vulnerabilities found on AirMax Ai (no CVSS, AirMax AirOS for TI, XW and XM boards) - [CVE-2020-8171](https://cve.now/CVE-2020-8171.md): We have recently released new version of AirMax AirOS firmware v6.3.0 for TI, XW and XM boards that fixes vulnerabilities found on AirMax Ai (no CVSS, AirMax AirOS for TI, XW and XM boards) - [CVE-2020-8170](https://cve.now/CVE-2020-8170.md): We have recently released new version of AirMax AirOS firmware v6.3.0 for TI, XW and XM boards that fixes vulnerabilities found on AirMax Ai (no CVSS, AirMax AirOS for TI, XW and XM boards) - [CVE-2020-10719](https://cve.now/CVE-2020-10719.md): A flaw was found in Undertow in versions before 2.1.1.Final, regarding the processing of invalid HTTP requests with large chunk sizes. (CVSS 6.5, Red Hat undertow · io.undertow:undertow-core) - [CVE-2020-10751](https://cve.now/CVE-2020-10751.md): A flaw was found in the Linux kernels SELinux LSM hook implementation before version 5.7, where it incorrectly assumed that an skb would onl (CVSS 6.1, The Linux Foundation kernel) - [CVE-2020-13487](https://cve.now/CVE-2020-13487.md): The bbPress plugin through 2.6.4 for WordPress has stored XSS in the Forum creation section, resulting in JavaScript execution at wp-admin/e (no CVSS, bbpress/bbpress) - [CVE-2020-3811](https://cve.now/CVE-2020-3811.md): qmail-verify as used in netqmail 1.06 is prone to a mail-address verification bypass vulnerability. (no CVSS, Debian netqmail) - [CVE-2020-3812](https://cve.now/CVE-2020-3812.md): qmail-verify as used in netqmail 1.06 is prone to an information disclosure vulnerability. (no CVSS, Debian netqmail) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2020-05-26 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.