# CVEs published 2020-05-28 31 CVEs were published on May 28, 2020: 0 critical, 7 high. Days are UTC. - [CVE-2020-13693](https://cve.now/CVE-2020-13693.md): An unauthenticated privilege-escalation issue exists in the bbPress plugin before 2.6.5 for WordPress when New User Registration is enabled. (no CVSS, bbpress/bbpress) - [CVE-2020-11082](https://cve.now/CVE-2020-11082.md): Cross-Site Scripting in Kaminari (CVSS 6.4, Kaminari) - [CVE-2020-13173](https://cve.now/CVE-2020-13173.md): Initialization of the pcoip\_credential\_provider in Teradici PCoIP Standard Agent for Windows and PCoIP Graphics Agent for Windows versions 1 (no CVSS, PCoIP Standard Agent for Windows, PCoIP Graphics Agent for…) - [CVE-2019-6342](https://cve.now/CVE-2019-6342.md): Drupal core - Critical - Access bypass - SA-CORE-2019-008 (no CVSS, Drupal Core · drupal/core) - [CVE-2020-5357](https://cve.now/CVE-2020-5357.md): Dell Dock Firmware Update Utilities for Dell Client Consumer and Commercial docking stations contain an Arbitrary File Overwrite vulnerabili (CVSS 7.1, Dell CPG BIOS) - [CVE-2020-13660](https://cve.now/CVE-2020-13660.md): CMS Made Simple through 2.2.14 allows XSS via a crafted File Picker profile name. (no CVSS) - [CVE-2020-11079](https://cve.now/CVE-2020-11079.md): command injection fix in node-dns-sync (CVSS 8.6, skoranga node-dns-sync · dns-sync) - [CVE-2020-13245](https://cve.now/CVE-2020-13245.md): Certain NETGEAR devices are affected by Missing SSL Certificate Validation. (no CVSS) - [CVE-2020-8330](https://cve.now/CVE-2020-8330.md): A denial of service vulnerability was reported in the firmware prior to version 1.01 used in Lenovo Printer LJ4010DN that could be triggered (CVSS 5.3, Lenovo Printer LJ4010DN) - [CVE-2020-8329](https://cve.now/CVE-2020-8329.md): A denial of service vulnerability was reported in the firmware prior to version 1.01 used in Lenovo Printer LJ4010DN that could be triggered (CVSS 5.3, Lenovo Printer LJ4010DN) - [CVE-2020-4248](https://cve.now/CVE-2020-4248.md): IBM Security Identity Governance and Intelligence 5.2.6 could allow a remote attacker to obtain sensitive information when a detailed techni (CVSS 2.7, IBM Security Identity Governance and Intelligence) - [CVE-2020-4419](https://cve.now/CVE-2020-4419.md): IBM Jazz Reporting Service 6.0.6, 6.0.6.1, and 7.0 is vulnerable to cross-site scripting. (CVSS 5.4, IBM Jazz Reporting Service) - [CVE-2020-4249](https://cve.now/CVE-2020-4249.md): IBM Security Identity Governance and Intelligence 5.2.6 could disclose highly sensitive information to other authenticated users on the syte (CVSS 6.5, IBM Security Identity Governance and Intelligence) - [CVE-2020-4246](https://cve.now/CVE-2020-4246.md): IBM Security Identity Governance and Intelligence 5.2.6 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML d (CVSS 7.1, IBM Security Identity Governance and Intelligence) - [CVE-2020-4245](https://cve.now/CVE-2020-4245.md): IBM Security Identity Governance and Intelligence 5.2.6 does not require that users should have strong passwords by default, which makes it (CVSS 5.9, IBM Security Identity Governance and Intelligence) - [CVE-2020-4244](https://cve.now/CVE-2020-4244.md): IBM Security Identity Governance and Intelligence 5.2.6 could allow an unauthorized user to obtain sensitive information through user enumer (CVSS 5.3, IBM Security Identity Governance and Intelligence) - [CVE-2020-4233](https://cve.now/CVE-2020-4233.md): IBM Security Identity Governance and Intelligence 5.2.6 could allow a remote attacker to obtain sensitive information, caused by the failure (CVSS 3.7, IBM Security Identity Governance and Intelligence) - [CVE-2020-4232](https://cve.now/CVE-2020-4232.md): IBM Security Identity Governance and Intelligence 5.2.6 could allow an attacker to enumerate usernames to find valid login credentials which (CVSS 5.3, IBM Security Identity Governance and Intelligence) - [CVE-2020-4231](https://cve.now/CVE-2020-4231.md): IBM Security Identity Governance and Intelligence 5.2.6 could allow an authenticated user to perform unauthorized commands due to hazardous (CVSS 4.3, IBM Security Identity Governance and Intelligence) - [CVE-2020-13362](https://cve.now/CVE-2020-13362.md): In QEMU 5.0.0 and earlier, megasas\_lookup\_frame in hw/scsi/megasas.c has an out-of-bounds read via a crafted reply\_queue\_head field from a g (no CVSS) - [CVE-2020-13649](https://cve.now/CVE-2020-13649.md): parser/js/js-scanner.c in JerryScript 2.2.0 mishandles errors during certain out-of-memory conditions, as demonstrated by a scanner\_reverse\_ (no CVSS) - [CVE-2020-13361](https://cve.now/CVE-2020-13361.md): In QEMU 5.0.0 and earlier, es1370\_transfer\_audio in hw/audio/es1370.c does not properly validate the frame count, which allows guest OS user (no CVSS) - [CVE-2020-7812](https://cve.now/CVE-2020-7812.md): Kaoni ezHTTPTrans Active-X File Download and Execution Vulnerability (CVSS 7.8, Kaoni ezHTTPTrans) - [CVE-2019-20807](https://cve.now/CVE-2019-20807.md): In Vim before 8.1.0881, users can circumvent the rvim restricted mode and execute arbitrary OS commands via scripting interfaces (e.g., Pyth (no CVSS) - [CVE-2020-11950](https://cve.now/CVE-2020-11950.md): VIVOTEK Network Cameras before XXXXX-VVTK-2.2002.xx.01x (and before XXXXX-VVTK-0XXXX\_Beta2) allows an authenticated user to upload and execu (no CVSS) - [CVE-2020-11949](https://cve.now/CVE-2020-11949.md): testserver.cgi of the web service on VIVOTEK Network Cameras before XXXXX-VVTK-2.2002.xx.01x (and before XXXXX-VVTK-0XXXX\_Beta2) allows an a (no CVSS) - [CVE-2020-13645](https://cve.now/CVE-2020-13645.md): In GNOME glib-networking through 2.64.2, the implementation of GTlsClientConnection skips hostname verification of the server's TLS certific (no CVSS) - [CVE-2020-13642](https://cve.now/CVE-2020-13642.md): An issue was discovered in the SiteOrigin Page Builder plugin before 2.10.16 for WordPress. (CVSS 8.8) - [CVE-2020-13643](https://cve.now/CVE-2020-13643.md): An issue was discovered in the SiteOrigin Page Builder plugin before 2.10.16 for WordPress. (CVSS 8.8) - [CVE-2020-13644](https://cve.now/CVE-2020-13644.md): An issue was discovered in the Accordion plugin before 2.2.9 for WordPress. (CVSS 5.4) - [CVE-2020-13641](https://cve.now/CVE-2020-13641.md): An issue was discovered in the Real-Time Find and Replace plugin before 4.0.2 for WordPress. (CVSS 8.8) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2020-05-28 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.