CVEs published in May 2020
1,061 vulnerabilities, 140 critical, 11 exploited.
- nlnetlabs unbound, canonical ubuntu linux, debian linux +2 more +4 moreUnbound before 1.10.1 has an infinite loop via malformed DNS answers received from upstream servers.7.5 High
- nlnetlabs unbound, canonical ubuntu linux, debian linux +2 more +4 moreUnbound before 1.10.1 has Insufficient Control of Network Message Volume, aka an "NXNSAttack"...7.5 High
- isc bind, canonical ubuntu linux, debian linux +3 more +5 moreA logic error in code which checks TSIG validity can be used to trigger an assertion failure in tsig.c7.5 High
- isc bind, debian linux, isc bind9 +2 moreBIND does not sufficiently limit the number of fetches performed when processing referrals8.6 High
- jquery, juniper junos, netapp active iq unified manager +4 more +6 moreCross-Site Scripting in jquery6.1 Medium
- nic knot resolverKnot Resolver before 5.1.1 allows traffic amplification via a crafted DNS answer from an attacker...7.5 High
- ivanti workspace controlIn Ivanti WorkSpace Control before 10.4.40.0, a user can elevate rights on the system by...7.8 High
- zohocorp manageengine servicedesk plusZoho ManageEngine Service Plus before 11.1 build 11112 allows low-privilege authenticated users...6.5 Medium
- facebook proxygenA use-after-free is possible due to an error in lifetime management in the request adaptor when a...9.8 Critical
- misp-project mispapp/View/Events/resolved_attributes.ctp in MISP before 2.4.126 has XSS in the resolved attributes...6.1 Medium
- dolibarrXSS in Dolibarr5.4 Medium
- msi dragon centerWeak permissions on the "%PROGRAMDATA%\MSI\Dragon Center" folder in Dragon Center 2.6.2003.2401,...7.8 High
- edx open edx platformStudio in Open edX Ironwood 2.5 allows users to upload SVG files via the "Content>File Uploads"...5.4 Medium
- edx open edx platformStudio in Open edX Ironwood 2.5 allows CSV injection because an added cohort in Course>Instructor...8.8 High
- edx open edx platformStudio in Open edX Ironwood 2.5, when CodeJail is not used, allows a user to go to the "Create...8.8 High
- debian linux, linux kernel, canonical ubuntu linux +21 more +23 moregadget_dev_desc_UDC_store in drivers/usb/gadget/configfs.c in the Linux kernel through 5.6.13...6.5 Medium
- wowza streaming engineA Reflected XSS was found in the server selection box inside the login page at: enginemanager...6.1 Medium
- wowza streaming engineAn arbitrary file download was found in the "Download Log" functionality of Wowza Streaming...7.5 High
- gonitro nitro pro, nitro pro +1 moreAn exploitable information disclosure vulnerability exists in the way Nitro Pro 13.9.1.155 does...6.5 Medium
- gonitro nitro pro, nitro pro +1 moreAn exploitable code execution vulnerability exists in the way Nitro Pro 13.9.1.155 parses Pattern...8.8 High
- gonitro nitro pro, nitro pro +1 moreAn exploitable code execution vulnerability exists in the PDF parser of Nitro Pro 13.9.1.155. A...8.8 High
- horde gollem, groupware +1 moreGollem before 3.0.13, as used in Horde Groupware Webmail Edition 5.2.22 and other products, is...6.1 Medium
- dlink dsp-w215 firmwareD-Link DSP-W215 1.26b03 devices allow information disclosure by intercepting messages on the...6.5 Medium
- dlink dsp-w215 firmwareD-Link DSP-W215 1.26b03 devices send an obfuscated hash that can be retrieved and understood by a...7.5 High
- amd atillk64An issue was discovered in atillk64.sys in AMD ATI Diagnostics Hardware Abstraction Sys...6.7 Medium
- amd overdriveAn issue was discovered in AODDriver2.sys in AMD OverDrive. The vulnerable driver exposes a wrmsr...9.8 Critical
- netgear rbs50y firmware, srr60 firmware, srs60 firmware +2 moreAn issue was discovered on NETGEAR Orbi Tri-Band Business WiFi Add-on Satellite (SRS60) AC3000 V2...8.3 High
- netgear rbs50y firmware, srr60 firmware, srs60 firmware +2 moreAn issue was discovered on NETGEAR Orbi Tri-Band Business WiFi Add-on Satellite (SRS60) AC3000 V2...7.4 High
- netgear rbs50y firmware, srr60 firmware, srs60 firmware +2 moreAn issue was discovered on NETGEAR Orbi Tri-Band Business WiFi Add-on Satellite (SRS60) AC3000 V2...9.6 Critical
- horde groupwareThe image view functionality in Horde Groupware Webmail Edition before 5.2.22 is affected by a...6.1 Medium
- libreoffice, opensuse leap +1 moreCrash-recovered MSOffice encrypted documents defaulted to not to using encryption on next save5.3 Medium
- rconfigrConfig 3.9.4 is vulnerable to remote code execution due to improper validation in the file...8.8 High
- rconfigrConfig 3.9.4 is vulnerable to reflected XSS. The devicemgmnt.php file improperly validates user...5.4 Medium
- rconfigrConfig 3.9.4 is vulnerable to cross-site request forgery (CSRF) because it lacks implementation...8.8 High
- [unknown] dpdk, dpdk data plane development kit, fedoraproject fedora +2 more +4 moreA vulnerability was found in DPDK versions 19.11 and above. A malicious container that has direct...6.0 Medium
- [unknown] dpdk, dpdk data plane development kit, fedoraproject fedora +2 more +4 moreA flaw was found in DPDK version 19.11 and above that allows a malicious guest to cause a...7.7 High
- [unknown] dpdk, canonical ubuntu linux, dpdk data plane development kit +1 more +3 moreA vulnerability was found in DPDK versions 18.11 and above. The vhost-crypto library code is...5.1 Medium
- [unknown] dpdk, canonical ubuntu linux, dpdk data plane development kit +4 more +6 moreA memory corruption issue was found in DPDK versions 17.05 and above. This flaw is caused by an...5.1 Medium
- microfocus enterprise developer, enterprise server +1 moreCross Site scripting vulnerability on Micro Focus Enterprise Server and Enterprise developer,...5.4 Medium
- rconfigrConfig 3.9.4 is vulnerable to session fixation because session expiry and randomization are...9.1 Critical
- rconfigrConfig 3.9.4 is vulnerable to reflected XSS. The configDevice.php file improperly validates user...5.4 Medium
- dovecotIn Dovecot before 2.3.10.1, remote unauthenticated attackers can crash the lmtp or submission...5.3 Medium
- dovecotIn Dovecot before 2.3.10.1, a crafted SMTP/LMTP message triggers an unauthenticated use-after...5.3 Medium
- dovecotIn Dovecot before 2.3.10.1, unauthenticated sending of malformed parameters to a NOOP command...7.5 High
- heinekingmedia stashcatAn issue was discovered in the stashcat app through 3.9.1 for macOS, Windows, Android, iOS, and...7.2 High
- health covidsafeCOVIDSafe through v1.0.17 allows a remote attacker to access phone name and model information...5.3 Medium
- health covidsafeUnnecessary fields in the OpenTrace/BlueTrace protocol in COVIDSafe through v1.0.17 allow a...5.3 Medium
- health covidsafeNon-reinitialisation of random data in the advertising payload in COVIDSafe v1.0.15 and v1.0.16 allows a remote attacker to re-identify Android devices running COVIDSafe by scanning for their advertis…7.5 High
- health covidsafeCaching of GATT characteristic values (TempID) in COVIDSafe v1.0.15 and v1.0.16 allows a remote attacker to long-term re-identify an Android device running COVIDSafe.7.5 High
- alberta abtracetogether, health covidsafe, tracetogether +2 moreOpenTrace, as used in COVIDSafe through v1.0.17, TraceTogether, ABTraceTogether, and other...9.8 Critical
- Show moreLoading…