CVEs published in May 2020
1,061 vulnerabilities, 140 critical, 11 exploited.
- ibm spectrum scaleIBM Spectrum Scale 5.0.0.0 through 5.0.4.4 uses weaker than expected cryptographic algorithms...5.9 Medium
- ibm spectrum scaleIBM Spectrum Scale 5.0.0.0 through 5.0.4.4 uses weaker than expected cryptographic algorithms...5.9 Medium
- ibm spectrum scaleIBM Spectrum Scale 4.2.0.0 through 4.2.3.21 and 5.0.0.0 through 5.0.4.4 could allow an...6.5 Medium
- ibm mobilefirst platform foundationIBM MobileFirst Platform Foundation 8.0.0.0 stores highly sensitive information in URL parameters...5.9 Medium
- smartdraw 2020In SmartDraw 2020 27.0.0.0, the installer gives inherited write permissions to the Authenticated...8.2 High
- linux kernelAn issue was discovered in the Linux kernel before 5.2. There is a NULL pointer dereference in...4.4 Medium
- rocketData races in rocket8.1 High
- red hat oddjobA race condition was found in the mkhomedir tool shipped with the oddjob package in versions...6.3 Medium
- jerryscriptJerryScript 2.2.0 allows attackers to cause a denial of service (assertion failure) because a...7.5 High
- jerryscriptJerryScript 2.2.0 allows attackers to cause a denial of service (stack consumption) via a proxy...7.5 High
- axel project axel, fedoraproject fedora, opensuse backports sle +1 more +3 moreAn issue was discovered in ssl.c in Axel before 2.17.8. The TLS implementation lacks hostname...5.9 Medium
- qorelib/QoreSocket.cpp in Qore before 0.9.4.2 lacks hostname verification for X.509 certificates.5.9 Medium
- pichi project pichiThe boost ASIO wrapper in net/asio.cpp in Pichi before 1.3.0 lacks TLS hostname verification.5.9 Medium
- johnsoncontrols kantech entrapass, johnson controls kantech entrapass security management software corporate edition versions 8.22 and prior, kantech entrapass security management software global edition versions 8.22 and prior +1 more +3 moreKantech EntraPass Security Management Software - System Permissions Vulnerability8.8 High
- mozilla firefox for ios, firefox mobile +1 moreFor native-to-JS bridging, the app requires a unique token to be passed that ensures non-app code...7.5 High
- ui airosWe have recently released new version of AirMax AirOS firmware v6.3.0 for TI, XW and XM boards...8.8 High
- ui airosWe have recently released new version of AirMax AirOS firmware v6.3.0 for TI, XW and XM boards...9.8 Critical
- ui airosWe have recently released new version of AirMax AirOS firmware v6.3.0 for TI, XW and XM boards...6.1 Medium
- rubyonrails rails, debian linux, rails https://github.com/rails/rails +2 moreAbility to forge per-form CSRF tokens in Rails4.3 Medium
- rubyonrails rails, debian linux, rails https://github.com/rails/rails +2 moreCircumvention of file size limits in ActiveStorage7.5 High
- rubyonrails rails, debian linux, opensuse backports sle +2 more +4 morePossible Strong Parameters Bypass in ActionPack7.5 High
- red hat undertow, netapp active iq unified manager, oncommand insight +5 more +7 moreHTTP Request Smuggling in Undertow6.5 Medium
- kernel selinux, linux kernel, redhat enterprise linux server +2 moreA flaw was found in the Linux kernels SELinux LSM hook implementation before version 5.7, where...6.1 Medium
- rubyonrails rails, debian linux, opensuse leap +1 more +3 moreActiveSupport potentially unintended unmarshalling of user-provided objects in MemCacheStore and RedisCacheStore9.8 Critical
- bbpressbbPress stored Cross-Site Scripting (XSS) vulnerability in the Forum creation section4.8 Medium
MozillaFirefoxSUSE,mozilla-nsprSUSE,mozilla-nssSUSE +14 more +16 moreSecurity update for MozillaFirefox, mozilla-nss, mozilla-nsprNo scoreblock-cipher-traitcrates.iocrate has been renamed to `block-cipher`No score- drupal, drupal core +1 moreDrupal Core Open Redirect vulnerability6.1 Medium
- qemu, canonical ubuntu linux, debian linux +2 moreIn QEMU through 5.0.0, an integer overflow was found in the SM501 display driver implementation....3.8 Low
- mozilla firefox, firefox esr, thunderbird +1 more +3 moreNSS has shown timing differences when performing DSA signatures, which was exploitable and could...4.4 Medium
- verbb knock knockKnock Knock plugin IP Whitelist bypass via an X-Forwarded-For HTTP header9.1 Critical
- verbb knock knockKnock Knock plugin Open redirection vulnerability6.1 Medium
- em-http-request project em-http-request, fedoraproject fedora +1 moreImproper Certificate Validation in EM-HTTP-Request7.4 High
- verbb image resizerImage Resizer Cross-Site Request Forgery (CSRF)8.8 High
- verbb image resizerImage Resizer Cross-site Scripting (XSS) in the Bulk Resize action5.4 Medium
- dext5A Remote code execution vulnerability exists in DEXT5Upload in DEXT5 through 2.7.1402870. An...9.8 Critical
- cybozu desktop, cybozu, inc. cybozu desktop for windows +1 moreCybozu Desktop for Windows 2.0.23 to 2.2.40 allows remote code execution via unspecified vectors.9.8 Critical
- rockcarry ffjpegffjpeg through 2020-02-24 has an invalid read in jfif_encode in jfif.c.6.5 Medium
- rockcarry ffjpegffjpeg through 2020-02-24 has an invalid write in bmp_load in bmp.c.6.5 Medium
- rockcarry ffjpegffjpeg through 2020-02-24 has a heap-based buffer over-read in jfif_decode in jfif.c.6.5 Medium
- sqlite, apple icloud, ipados +15 more +17 moreSQLite through 3.32.0 has an integer overflow in sqlite3_str_vappendf in printf.c.5.5 Medium
- sqlite, fedoraproject fedora, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp +2 more +4 moreSQLite through 3.32.0 has a segmentation fault in sqlite3ExprCodeTarget in expr.c.5.5 Medium
- adminpanel project adminpanelJason2605 AdminPanel 4.0 allows SQL Injection via the editPlayer.php hidden parameter.9.8 Critical
microcodeMageiaUpdated microcode packages fix security issuesNo scorewiresharkMageiaUpdated wireshark packages fix security vulnerabilityNo score- grafana piechart-panellegend.ts in the piechart-panel (aka Pie Chart Panel) plugin before 1.5.0 for Grafana allows XSS...5.4 Medium
- grafanaGrafana XSS via the OpenTSDB datasource6.1 Medium
- debian netqmail, canonical ubuntu linux, debian linux +2 moreqmail-verify as used in netqmail 1.06 is prone to an information disclosure vulnerability. A...5.5 Medium
- debian netqmail, canonical ubuntu linux, debian linux +2 moreqmail-verify as used in netqmail 1.06 is prone to a mail-address verification bypass vulnerability.7.5 High
- thetrackr trackr firmwareTrackR devices through 2020-05-06 allow attackers to trigger the Beep (aka alarm) feature, which...7.1 High
- Show moreLoading…