CVEs published in May 2020
1,061 vulnerabilities, 140 critical, 11 exploited.
- dolibarr erp\/crmDolibarr Stored Cross-site Scripting via file upload5.4 Medium
- dolibarr erp\/crmDolibarr Stored Cross-site Scripting5.4 Medium
- cacti, fedoraproject fedora +1 moreIn Cacti before 1.2.11, auth_profile.php?action=edit allows CSRF for an admin email change.6.5 Medium
- apache couchdbCouchDB version 3.0.0 shipped with a new configuration setting that governs access control to the...9.8 Critical
- cacti, debian linux, fedoraproject fedora +2 moreIn Cacti before 1.2.11, disabling a user account does not immediately invalidate any permissions...4.3 Medium
- signal private messenger, signal +1 moreSignal Private Messenger Android v4.59.0 and up and iOS v3.8.1.5 and up allows a remote non...5.3 Medium
- vmware vcloud directorVMware Cloud Director 10.0.x before 10.0.0.2, 9.7.0.x before 9.7.0.5, 9.5.0.x before 9.5.0.6, and...8.8 High
- panasonic eluga ray 530 firmware, eluga ray 600 firmware, eluga x1 firmware +3 more +5 morePanasonic P110, Eluga Z1 Pro, Eluga X1, and Eluga X1 Pro devices through 2020-04-10 have Insecure...9.8 Critical
- smartbear readyapiAn issue was discovered in SmartBear ReadyAPI SoapUI Pro 3.2.5. Due to unsafe use of an Java RMI...9.8 Critical
- ibm security access manager appliance, security access manager +1 moreIBM Security Access Manager Appliance 9.0.7.1 could allow an authenticated user to bypass...6.5 Medium
- kde amarokA remote user can create a specially crafted M3U file, media playlist file that when loaded by...5.5 Medium
- tibco jasperreports library, jasperreports server, tibco software inc. jasperreports library for activematrix bpm +3 more +5 moreTIBCO JasperReports Library7.3 High
- tibco jasperreports server, tibco software inc. jasperreports server for activematrix bpm, jasperreports server for aws marketplace +1 more +3 moreTIBCO JasperReports Server Fails To Enforce Access Restrictions9.8 Critical
- wso2 api managerWSO2 API Manager vulnerable to SSRF9.8 Critical
- stranger studios paid memberships, strangerstudios paid memberships pro +1 moreSQL injection vulnerability in the Paid Memberships versions prior to 2.3.3 allows attacker with...7.2 High
- panasonic video insight vmsVideo Insight VMS 7.5 and earlier allows remote attackers to conduct code injection attacks via...9.8 Critical
- phpTemporary files are not cleaned after OOM when parsing HTTP request data5.3 Medium
- phpipamphpIPAM 1.4 contains a stored cross site scripting (XSS) vulnerability within the Edit User...4.8 Medium
- rockwellautomation eds subsystem, rslinx, rslinx enterprise +2 more +4 moreProducts that use EDS Subsystem: Version 28.0.1 and prior (FactoryTalk Linx software (Previously...8.2 High
- naver whale browser installerWhale Browser Installer before 1.2.0.5 versions don't support signature verification for Flash...9.1 Critical
- hpe nimbleosPotential remote code execution security vulnerabilities have been identified with HPE Nimble...8.8 High
- hpe nimbleosPotential remote access security vulnerabilities have been identified with HPE Nimble Storage...8.1 High
- hpe superdome flex server, superdome flex server firmware +1 moreA validation issue in HPE Superdome Flex's RMC component may allow local elevation of privilege....6.7 Medium
- rockwellautomation eds subsystem, rslinx, rslinx enterprise +2 more +4 moreProducts that use EDS Subsystem: Version 28.0.1 and prior (FactoryTalk Linx software (Previously...5.5 Medium
- wireshark, debian linux, fedoraproject fedora +1 more +3 moreIn Wireshark 3.2.0 to 3.2.3, 3.0.0 to 3.0.10, and 2.6.0 to 2.6.16, the NFS dissector could crash....7.5 High
- em-imap project em-imapImproper certificate validation in em-imap7.4 High
- kata containers containers, katacontainers runtime +1 moreKata Containers - Cloud Hypervisor guests persist filesystem changes to the underlying host image file8.8 High
- kata containers containers, katacontainers runtime +1 moreKata Containers - Guests can trick the kata-runtime into unmounting any mount point on the host6.5 Medium
- mylittletools mylittleadminThe management tool in MyLittleAdmin 3.8 allows remote attackers to execute arbitrary code...9.8 Critical
- netsweeperNetsweeper through 6.4.3 allows unauthenticated remote code execution because webadmin/tools...9.8 Critical
- avantfax, ifax hylafax +1 moresendfax.php in iFAX AvantFAX before 3.3.6 and HylaFAX Enterprise Web Interface before 0.2.5...8.8 High
- panasonic p99 firmwarePanasonic P99 devices through 2020-04-10 have Incorrect Access Control. NOTE: the vendor states...9.8 Critical
- ceph ceph-ansibleA flaw was found in the ceph-ansible playbook where it contained hardcoded passwords that were...8.8 High
- sourcefabric newscoopBecause of Unrestricted Upload of a File with a Dangerous Type, Sourcefabric Newscoop 4.4.7...7.8 High
- bluetooth core, br/edr, opensuse leap +2 moreBluetooth devices supporting BR/EDR v5.2 and earlier are vulnerable to impersonation attacks5.4 Medium
- bluetooth core, le +1 moreBluetooth devices supporting LE and specific BR/EDR implementations are vulnerable to method confusion attacks6.3 Medium
- opensuse open build service, debian linux +1 moreunauthorized read access to files where sourceaccess is disabled via a crafted _service file in Open Build Service5.3 Medium
- red hat resteasy, fedoraproject fedora +1 moreImproper Input Validation in RESTEasy7.5 High
- microfocus service managerCross Site Scripting vulnerability in Micro Focus Service Manager product. Affecting versions 9...6.1 Medium
- ibm spectrum scaleThe Spectrum Scale 4.2.0.0 through 4.2.3.21 and 5.0.0.0 through 5.0.4.3 file system component is...5.3 Medium
- ibm spectrum scaleThe Spectrum Scale 4.2.0.0 through 4.2.3.21 and 5.0.0.0 through 5.0.4.3 file system component is...7.1 High
- ibm infosphere information server, infosphere information server on cloud +1 moreIBM InfoSphere Information Server 11.3, 11.5, and 11.7 is vulnerable to cross-site scripting....5.4 Medium
- ibm infosphere information server, infosphere information server on cloud +1 moreIBM InfoSphere Information Server 11.3, 11.5, and 11.7 is vulnerable to cross-site request...4.3 Medium
- pcs dexicon enterprisePCS DEXICON 3.4.1 allows XSS via the loginName parameter in login_action.jsp.6.1 Medium
- jenzabar internet campus solutionJenzabar JICS (aka Internet Campus Solution) before 9.0.1 Patch 3, 9.1 before 9.1.2 Patch 2, and...9.8 Critical
- tokio tokio-rustlsExcessive memory usage in tokio-rustls7.5 High
- powerdns recursor, debian linux, fedoraproject fedora +2 more +4 moreAn issue has been found in PowerDNS Recursor 4.1.0 through 4.3.0 where records in the answer...7.5 High
- powerdns recursor, debian linux, fedoraproject fedora +2 more +4 morePowerDNS Recursor from 4.1.0 up to and including 4.3.0 does not sufficiently defend against...7.5 High
- powerdns recursorAn issue has been found in PowerDNS Recursor 4.1.0 up to and including 4.3.0. It allows an...8.8 High
rpmlint-miniSUSESecurity update for rpmlintNo score- Show moreLoading…