CVEs published in May 2020
1,061 vulnerabilities, 140 critical, 11 exploited.
- typo3 svg sanitizerCross-Site Scripting in SVG Sanitizer5.4 Medium
- keycloak, quarkus, redhat decision manager +4 more +6 moreImproper Input Validation in Keycloak7.5 High
- simplefilelist simple-file-listThe simple-file-list plugin before 4.2.8 for WordPress mishandles a .. sequence within a pathname...9.8 Critical
- linuxfoundation free range routing** DISPUTED ** An issue was discovered in FRRouting FRR (aka Free Range Routing) through 7.3.1....5.3 Medium
- pivotal software spring security, spring security +1 moreSignature Wrapping Vulnerability with spring-security-saml2-service-provider8.8 High
drupal/recaptcha_v3PackagistThe reCaptcha v3 module enables you to protect your forms using the Google reCaptcha V3. If the reCaptcha v3 challenge succeeds, all the other form validations are bypassed. This makes it possible for…No scoredrupal/webformPackagistThis webform module enables you to build a 'Term checkboxes' element. The module doesn't sufficiently check term 'view' access when rendering 'Term checkboxes' elements. Unpublished terms will always…No score- mongodb ops managerPotential exposure of log information in Ops Manager5.8 Medium
- symantec it analyticsSymantec IT Analytics, prior to 2.9.1, may be susceptible to a cross-site scripting (XSS) exploit...4.8 Medium
- freebsdIn FreeBSD 12.1-STABLE before r356911, and 12.1-RELEASE before p5, insufficient checking in the...9.8 Critical
- freebsdIn FreeBSD 12.1-STABLE before r356908, 12.1-RELEASE before p5, 11.3-STABLE before r356908, and 11...7.4 High
- freebsdIn FreeBSD 12.1-STABLE before r352509, 11.3-STABLE before r352509, and 11.3-RELEASE before p9, an...7.8 High
- freebsdIn FreeBSD 12.1-STABLE before r360973, 12.1-RELEASE before p5, 11.4-STABLE before r360973, 11.4...5.5 Medium
- freebsdIn FreeBSD 12.1-STABLE before r360971, 12.1-RELEASE before p5, 11.4-STABLE before r360971, 11.4...9.8 Critical
- dahuasecurity ipc-hdbw1320e-w firmware, ipc-hx2xxx firmware, ipc-hx5842h firmware +17 more +19 moreSome Dahua products with Build time before December 2019 have Session ID predictable...9.8 Critical
- dahuasecurity web p2pAttackers can obtain Cloud Key information from the Dahua Web P2P control in specific ways. Cloud...5.5 Medium
- dahuasecurity ipc-hdbw1320e-w firmware, ipc-hx2xxx firmware, ipc-hx5842h firmware +17 more +19 moreDahua devices with Build time before December 2019 use strong security login mode by default, but...8.1 High
- opensuse open-build-service, debian linux, opensuse open build service +2 morePersistent XSS in markdown parser used by obs-server6.5 Medium
- tylertech eagleTylerTech Eagle 2018.3.11 deserializes untrusted user input, resulting in remote code execution...8.8 High
- westerndigital wd discoveryThe Western Digital WD Discovery application before 3.8.229 for MyCloud Home on Windows and macOS...8.8 High
- trendnet tv-ip512wn firmwareTRENDnet ProView Wireless camera TV-IP512WN 1.0R 1.0.4 is vulnerable to an unauthenticated stack...9.8 Critical
- iubenda iubenda-cookie-law-solutionThe iubenda-cookie-law-solution plugin before 2.3.5 for WordPress does not restrict URL...6.1 Medium
- dkd direct mailMissing Authorization in TYPO3 extension4.3 Medium
- dkd direct mailOpen redirect in direct_mail6.1 Medium
- dkd direct mailMissing Authorization in TYPO3 extension4.3 Medium
- dkd direct mailDenial of service in direct_mail5.3 Medium
- pingidentity pingid ssh integrationPing Identity PingID SSH before 4.0.14 contains a heap buffer overflow in PingID-enrolled servers...9.8 Critical
- ibm sterling b2b integratorIBM Sterling B2B Integrator Standard Edition 5.2.0.0 trough 6.0.3.1 could allow an authenticated...4.3 Medium
fileUbuntufile regressionNo score- cisco clam antivirus, clamav, canonical ubuntu linux +2 more +4 moreClamAV PDF Parsing Denial of Service Vulnerability7.5 High
- cisco clam antivirus, clamav, canonical ubuntu linux +2 more +4 moreClamAV ARJ Archive Parsing Denial of Service Vulnerability7.5 High
- canonical apport, ubuntu linux +1 moreUnhandled exception in apport5.5 Medium
- xwiki, xwiki platform +1 moreCode Injection in XWiki Platform9.9 Critical
- keycloak, redhat jboss fuse, openshift application runtimes +2 moreImproper Authentication for Keycloak7.1 High
- debian apt, canonical ubuntu linux, debian linux +1 more +3 moreMissing input validation in the ar/tar implementations of APT before version 2.1.2 could result...5.5 Medium
- igniterealtime sparkAn issue was discovered in Ignite Realtime Spark 2.8.3 (and the ROAR plugin for it) on Windows. A...8.8 High
- glpi-project glpiRemote Code Execution in GLPI7.4 High
- glpiReflexive XSS in GLPI6.0 Medium
- linux kernel, canonical ubuntu linux, redhat enterprise linux +1 more +3 moreA signal access-control issue was discovered in the Linux kernel before 5.6.5, aka CID...5.3 Medium
- sap se business objects business intelligence platform (live data connect), sap businessobjects business intelligence platform +1 moreSAP Business Objects Business Intelligence Platform (Live Data Connect), versions 1.0, 2.0, 2.x,...9.8 Critical
- sap identity managementSAP Identity Management, version 8.0, does not perform necessary authorization checks for an...4.3 Medium
- sap enterprise threat detectionSAP Enterprise Threat Detection, versions 1.0, 2.0, does not sufficiently encode error response...6.1 Medium
- sap adaptive server enterpriseSAP Adaptive Server Enterprise, version 16.0, allows an authenticated user to execute crafted...8.8 High
- sap adaptive server enterpriseUnder certain conditions SAP Adaptive Server Enterprise, versions 15.7, 16.0, allows an attacker...6.5 Medium
- sap se adaptive server enterprise (cockpit), sap adaptive server enterprise cockpit +1 moreUnder certain conditions SAP Adaptive Server Enterprise (Cockpit), version 16.0, allows an...9.0 Critical
- sap adaptive server enterprise, sap se adaptive server enterprise (web services) +1 moreUnder certain conditions, SAP Adaptive Server Enterprise (Web Services), versions 15.7, 16.0,...7.2 High
- sap business clientSAP Business Client, version 7.0, allows an attacker after a successful social engineering attack...7.0 High
- sap se business objects business intelligence platform (cmc and bi launchpad), sap businessobjects business intelligence platform +1 moreSAP Business Objects Business Intelligence Platform (CMC and BI Launchpad) 4.2 does not...5.4 Medium
firefoxUbuntufirefox regressionNo score- sap adaptive server enterpriseSAP Adaptive Server Enterprise, version 16.0, allows an authenticated attacker to exploit certain...6.8 Medium
- Show moreLoading…