CVEs published in May 2020
1,061 vulnerabilities, 140 critical, 11 exploited.
- gurbalib project gurbalibGurbalib through 2020-04-30 allows lib/cmds/player/help.c directory traversal for reading...7.5 High
- keycloakKeycloak users may be able to remove MFA from other users' devices4.1 Medium
- dell cpg sw, os recovery image for microsoft windows 10 +1 moreDell Client platforms restored using a Dell OS recovery image downloaded before December 20, 2019...7.3 High
- dell rsa archer, rsa archer +1 moreRSA Archer, versions prior to 6.7 P1 (6.7.0.1), contain a URL redirection vulnerability. A remote...4.6 Medium
- dell rsa archer, rsa archer +1 moreRSA Archer, versions prior to 6.7 P1 (6.7.0.1), contain a URL injection vulnerability. An...4.6 Medium
- dell rsa archer, rsa archer +1 moreRSA Archer, versions prior to 6.7 P2 (6.7.0.2), contain a cross-site request forgery...5.0 Medium
- dell rsa archer, rsa archer +1 moreRSA Archer, versions prior to 6.7 P2 (6.7.0.2), contains a Document Object Model (DOM) based...8.2 High
- dell rsa archer, rsa archer +1 moreRSA Archer, versions prior to 6.7 P3 (6.7.0.3), contain an authorization bypass vulnerability in...4.3 Medium
- dell rsa archer, rsa archer +1 moreRSA Archer, versions prior to 6.7 P3 (6.7.0.3), contain a command injection vulnerability. AN...7.2 High
- dell rsa archer, rsa archer +1 moreRSA Archer, versions prior to 6.7 P3 (6.7.0.3), contain an information exposure vulnerability....8.8 High
- lcds laquis scadaLCDS LAquis SCADA Versions 4.3.1 and prior. The affected product is vulnerable to arbitrary file...7.8 High
- lcds laquis scadaLCDS LAquis SCADA Versions 4.3.1 and prior. The affected product is vulnerable to sensitive...5.5 Medium
- red hat soteria, redhat jboss enterprise application platform, jboss enterprise application platform continuous delivery +1 more +3 moreA flaw was found in Soteria before 1.0.1, in a way that multiple requests occurring concurrently...4.2 Medium
- reportportal service-apiXXE vulnerability in Launch import7.5 High
- tp-link nc200 firmware, nc210 firmware, nc220 firmware +4 more +6 moreCertain TP-Link devices allow Command Injection. This affects NC200 2.1.9 build 200225, NC210 1.0...8.8 High
- roundcube webmail, opensuse backports sle, leap +2 moreRoundcube Webmail before 1.4.4 allows attackers to include local files and execute code via...9.8 Critical
- roundcube webmail, opensuse backports sle, leap +2 morercube_image.php in Roundcube Webmail before 1.4.4 allows attackers to execute arbitrary code via...9.8 Critical
- google tensorflowOut-of-bounds read in TensorFlow possibly causing disclosure of the contents of process memory.6.5 Medium
- tp-link nc260 firmware, nc450 firmware +1 moreCertain TP-Link devices allow Command Injection. This affects NC260 1.5.2 build 200304 and NC450...8.8 High
- tp-link nc200 firmware, nc210 firmware, nc220 firmware +4 more +6 moreCertain TP-Link devices have a Hardcoded Encryption Key. This affects NC200 2.1.9 build 200225,...9.8 Critical
- openvpn access serverAn issue was discovered in OpenVPN Access Server before 2.7.0 and 2.8.x before 2.8.3. With the...7.5 High
- zoom it installerThe MSI installer in Zoom before 4.6.10 on Windows follows Symbolic Links.8.1 High
- phplistphpList before 3.5.3 allows XSS, with resultant privilege elevation, via lists/admin/template.php.6.1 Medium
- cososys endpoint protectorCoSoSys Endpoint Protector 5.1.0.2 allows Host Header Injection.7.5 High
- tp-link omada controllerTP-Link Omada Controller Software 3.2.6 allows Directory Traversal for reading arbitrary files...5.5 Medium
- oklok project oklokThe OKLOK (3.1.1) mobile companion app for Fingerprint Bluetooth Padlock FB50 (2.3) has an...5.3 Medium
- solarwinds netpath, orion platform, network performance monitor +2 moreSolarWinds Orion Platform 2018.4 HF3 (NPM 12.4, NetPath 1.1.4) is vulnerable to Information...5.5 Medium
- ibm spectrum protect plusIBM Spectrum Protect Plus 10.1.0 through 10.1.5 could allow a remote attacker to traverse...5.4 Medium
- teampassMissing Authorization in TeamPass8.1 High
- google earth, google llc earth pro +1 moreBuffer Overflow in Google Earth Pro4.2 Medium
- oklok project oklokThe OKLOK (3.1.1) mobile companion app for Fingerprint Bluetooth Padlock FB50 (2.3) allows remote...6.5 Medium
- doorkeeper project doorkeeperExposure of Sensitive Information to an Unauthorized Actor in Doorkeeper7.5 High
- oklok project oklokThe OKLOK (3.1.1) mobile companion app for Fingerprint Bluetooth Padlock FB50 (2.3) has weak...9.8 Critical
- oklok project oklokThe OKLOK (3.1.1) mobile companion app for Fingerprint Bluetooth Padlock FB50 (2.3) does not...7.5 High
- microfocus verastream host integratorInformation disclosure vulnerability in Micro Focus Verastream Host Integrator (VHI) product,...7.5 High
- apache syncopeInjection in Apache Syncope9.8 Critical
- enhancesoft osticketinclude/class.sla.php in osTicket before 1.14.2 allows XSS via the SLA Name.5.4 Medium
- apache syncopeCross-site scripting in Apache Syncome EndUser5.4 Medium
- apache syncopeExpression Language Injection in Apache Syncope9.8 Critical
stdwebcrates.iostdweb is unmaintainedNo score- linux kernelA pivot_root race condition in fs/namespace.c in the Linux kernel 4.4.x before 4.4.221, 4.9.x...4.7 Medium
- suse linux enterprise server 15 sp1, linux enterprise desktop +1 moreUser owned /etc in SLES15-SP1-CHOST-BYOS8.4 High
- synology router manager, router manager (srm) +1 moreCRLF injection vulnerability in Network Center in Synology Router Manager (SRM) before 1.2.3-8017...8.6 High
- juniper junos, junos os +1 moreOut of Cycle Security Advisory: Junos OS: Security vulnerability in J-Web and web based (HTTP/HTTPS) services8.8 High
- janeczku calibre-webCalibre-Web 0.6.6 allows authentication bypass because of the 'A0Zr98j/3yX R~XHH!jmN]LWX/,?RT'...9.8 Critical
- roundcube webmail, debian linux, opensuse backports sle +1 more +3 moreAn issue was discovered in Roundcube Webmail before 1.4.4. There is a cross-site scripting (XSS)...6.1 Medium
- roundcube webmail, debian linux +1 moreAn issue was discovered in Roundcube Webmail before 1.4.4. A CSRF attack can cause an...6.5 Medium
- qemuA potential DoS flaw was found in the virtio-fs shared file system daemon (virtiofsd)...3.3 Low
- theleague the leagueThe League application before 2020-05-02 on Android sends a bearer token in an HTTP Authorization...6.5 Medium
- rust-lang futures-taskfutures_task::noop_waker_ref can segfault due to dereferencing a NULL pointer5.5 Medium
- Show moreLoading…