CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
  Take a third party risk management course for FREE
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Security Vulnerabilities Published In May 2020

CVSS Scores Greater Than: 0   1   2   3   4   5   6   7   8   9  
Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
451 CVE-2020-8434 384 2020-05-19 2020-05-27
5.0
 None Remote Low Not required Partial None None
Jenzabar JICS (aka Internet Campus Solution) before 9.0.1 Patch 3, 9.1 before 9.1.2 Patch 2, and 9.2 before 9.2.2 Patch 8 has session cookies that are a deterministic function of the username. There is a hard-coded password to supply a PBKDF feeding into AES to encrypt a username and base64 encode it to a client-side cookie for persistent session authentication. By knowing the key and algorithm, an attacker can select any username, encrypt it, base64 encode it, and save it in their browser with the correct JICSLoginCookie cookie format to impersonate any real user in the JICS database without the need for authenticating (or verifying with MFA if implemented).
452 CVE-2020-8330 20 DoS 2020-05-28 2021-07-21
7.8
 None Remote Low Not required None None Complete
A denial of service vulnerability was reported in the firmware prior to version 1.01 used in Lenovo Printer LJ4010DN that could be triggered by a remote user sending a crafted packet to the device, preventing subsequent print jobs until the printer is rebooted.
453 CVE-2020-8329 20 DoS 2020-05-28 2021-07-21
7.8
 None Remote Low Not required None None Complete
A denial of service vulnerability was reported in the firmware prior to version 1.01 used in Lenovo Printer LJ4010DN that could be triggered by a remote user sending a crafted packet to the device, causing an error to be displayed and preventing printer from functioning until the printer is rebooted.
454 CVE-2020-8171 78 Exec Code 2020-05-26 2020-05-28
7.5
 None Remote Low Not required Partial Partial Partial
We have recently released new version of AirMax AirOS firmware v6.3.0 for TI, XW and XM boards that fixes vulnerabilities found on AirMax AirOS v6.2.0 and prior TI, XW and XM boards, according to the description below:There are certain end-points containing functionalities that are vulnerable to command injection. It is possible to craft an input string that passes the filter check but still contains commands, resulting in remote code execution.Mitigation:Update to the latest AirMax AirOS firmware version available at the AirMax download page.
455 CVE-2020-8170 79 XSS 2020-05-26 2020-05-28
4.3
 None Remote Medium Not required None Partial None
We have recently released new version of AirMax AirOS firmware v6.3.0 for TI, XW and XM boards that fixes vulnerabilities found on AirMax AirOS v6.2.0 and prior TI, XW and XM boards, according to the description below:Multiple end-points with parameters vulnerable to reflected cross site scripting (XSS), allowing attackers to abuse the user' session information and/or account takeover of the admin user.Mitigation:Update to the latest AirMax AirOS firmware version available at the AirMax download page.
456 CVE-2020-8168 352 CSRF 2020-05-26 2020-05-28
6.8
 None Remote Medium Not required Partial Partial Partial
We have recently released new version of AirMax AirOS firmware v6.3.0 for TI, XW and XM boards that fixes vulnerabilities found on AirMax AirOS v6.2.0 and prior TI, XW and XM boards, according to the description below:Attackers can abuse multiple end-points not protected against cross-site request forgery (CSRF), as a result authenticated users can be persuaded to visit malicious web pages, which allows attackers to perform arbitrary actions, such as downgrade the device's firmware to older versions, modify configuration, upload arbitrary firmware, exfiltrate files and tokens.Mitigation:Update to the latest AirMax AirOS firmware version available at the AirMax download page.
457 CVE-2020-8159 22 Exec Code Dir. Trav. 2020-05-12 2022-04-05
7.5
 None Remote Low Not required Partial Partial Partial
There is a vulnerability in actionpack_page-caching gem < v1.2.1 that allows an attacker to write arbitrary files to a web server, potentially resulting in remote code execution if the attacker can write unescaped ERB to a view.
458 CVE-2020-8157 2020-05-02 2020-05-07
7.2
 None Local Low Not required Complete Complete Complete
UniFi Cloud Key firmware <= v1.1.10 for Cloud Key gen2 and Cloud Key gen2 Plus contains a vulnerability that allows unrestricted root access through the serial interface (UART).
459 CVE-2020-8156 295 2020-05-12 2020-10-19
6.8
 None Remote Medium Not required Partial Partial Partial
A missing verification of the TLS host in Nextcloud Mail 1.1.3 allowed a man in the middle attack.
460 CVE-2020-8155 79 XSS 2020-05-12 2020-10-19
3.5
 None Remote Medium ??? None Partial None
An outdated 3rd party library in the Files PDF viewer for Nextcloud Server 18.0.2 caused a Cross-site scripting vulnerability when opening a malicious PDF.
461 CVE-2020-8154 639 2020-05-12 2020-10-19
6.8
 None Remote Low ??? None None Complete
An Insecure direct object reference vulnerability in Nextcloud Server 18.0.2 allowed an attacker to remote wipe devices of other users when sending a malicious request directly to the endpoint.
462 CVE-2020-8153 732 2020-05-12 2020-10-19
5.5
 None Remote Low ??? None Partial Partial
Improper access control in Groupfolders app 4.0.3 allowed to delete hidden directories when when renaming an accessible item to the same name.
463 CVE-2020-8151 863 +Info 2020-05-12 2021-10-07
5.0
 None Remote Low Not required Partial None None
There is a possible information disclosure issue in Active Resource <v5.1.1 that could allow an attacker to create specially crafted requests to access data in an unexpected way and possibly leak information.
464 CVE-2020-8149 94 Exec Code 2020-05-15 2020-05-19
7.5
 None Remote Low Not required Partial Partial Partial
Lack of output sanitization allowed an attack to execute arbitrary shell commands via the logkitty npm package before version 0.7.1.
465 CVE-2020-8100 20 DoS 2020-05-15 2020-05-19
5.0
 None Remote Low Not required None None Partial
Improper Input Validation vulnerability in the cevakrnl.rv0 module as used in the Bitdefender Engines allows an attacker to trigger a denial of service while scanning a specially-crafted sample. This issue affects: Bitdefender Bitdefender Engines versions prior to 7.84063.
466 CVE-2020-8035 79 XSS 2020-05-18 2020-06-01
4.3
 None Remote Medium Not required None Partial None
The image view functionality in Horde Groupware Webmail Edition before 5.2.22 is affected by a stored Cross-Site Scripting (XSS) vulnerability via an SVG image upload containing a JavaScript payload. An attacker can obtain access to a victim's webmail account by making them visit a malicious URL.
467 CVE-2020-8034 79 XSS 2020-05-18 2020-05-31
4.3
 None Remote Medium Not required None Partial None
Gollem before 3.0.13, as used in Horde Groupware Webmail Edition 5.2.22 and other products, is affected by a reflected Cross-Site Scripting (XSS) vulnerability via the HTTP GET dir parameter in the browser functionality, affecting breadcrumb output. An attacker can obtain access to a victim's webmail account by making them visit a malicious URL.
468 CVE-2020-8033 79 XSS 2020-05-05 2020-05-07
4.3
 None Remote Medium Not required None Partial None
Ruckus R500 3.4.2.0.384 devices allow XSS via the index.asp Device Name field.
469 CVE-2020-8021 269 2020-05-19 2021-03-15
4.3
 None Remote Medium Not required Partial None None
a Improper Access Control vulnerability in of Open Build Service allows remote attackers to read files of an OBS package where the sourceaccess/access is disabled This issue affects: Open Build Service versions prior to 2.10.5.
470 CVE-2020-8020 79 XSS 2020-05-13 2021-03-15
4.3
 None Remote Medium Not required None Partial None
A Improper Neutralization of Input During Web Page Generation vulnerability in open-build-service allows remote attackers to store arbitrary JS code to cause XSS. This issue affects: openSUSE open-build-service versions prior to 7cc32c8e2ff7290698e101d9a80a9dc29a5500fb.
471 CVE-2020-8018 276 2020-05-04 2020-05-12
7.2
 None Local Low Not required Complete Complete Complete
A Incorrect Default Permissions vulnerability in the SLES15-SP1-CHOST-BYOS and SLES15-SP1-CAP-Deployment-BYOS images of SUSE Linux Enterprise Server 15 SP1 allows local attackers with the UID 1000 to escalate to root due to a /etc directory owned by the user This issue affects: SUSE Linux Enterprise Server 15 SP1 SLES15-SP1-CAP-Deployment-BYOS version 1.0.1 and prior versions; SLES15-SP1-CHOST-BYOS versions prior to 1.0.3 and prior versions;
472 CVE-2020-7983 352 CSRF 2020-05-05 2020-05-07
5.8
 None Remote Medium Not required Partial Partial None
A CSRF issue in login.asp on Ruckus R500 3.4.2.0.384 devices allows remote attackers to access the panel or conduct SSRF attacks.
473 CVE-2020-7921 863 Bypass 2020-05-06 2020-07-07
3.5
 None Remote Medium ??? None Partial None
Improper serialization of internal state in the authorization subsystem in MongoDB Server's authorization subsystem permits a user with valid credentials to bypass IP whitelisting protection mechanisms following administrative action. This issue affects: MongoDB Inc. MongoDB Server 4.2 versions prior to 4.2.3; 4.0 versions prior to 4.0.15; 4.3 versions prior to 4.3.3; 3.6 versions prior to 3.6.18.
474 CVE-2020-7813 494 Exec Code 2020-05-22 2020-05-27
7.5
 None Remote Low Not required Partial Partial Partial
Ezhttptrans.ocx ActiveX Control in Kaoni ezHTTPTrans 1.0.0.70 and prior versions contain a vulnerability that could allow remote attacker to download and execute arbitrary file by setting the arguments to the activex method. This can be leveraged for code execution.
475 CVE-2020-7812 494 Exec Code 2020-05-28 2020-05-28
7.5
 None Remote Low Not required Partial Partial Partial
Ezhttptrans.ocx ActiveX Control in Kaoni ezHTTPTrans 1.0.0.70 and prior versions contain a vulnerability that could allow remote attacker to download arbitrary file by setting the arguments to the activex method. This can be leveraged for code execution by rebooting the victim’s PC.
476 CVE-2020-7809 79 XSS 2020-05-15 2020-05-19
4.3
 None Remote Medium Not required None Partial None
ALSong 3.46 and earlier version contain a Document Object Model (DOM) based cross-site scripting vulnerability caused by improper validation of user input. A remote attacker could exploit this vulnerability by tricking the victim to open ALSong Album(sab) file.
477 CVE-2020-7808 88 2020-05-21 2020-05-22
7.5
 None Remote Low Not required Partial Partial Partial
In RAONWIZ K Upload v2018.0.2.51 and prior, automatic update processing without integrity check on update module(web.js) allows an attacker to modify arguments which causes downloading a random DLL and injection on it.
478 CVE-2020-7806 494 Exec Code 2020-05-06 2020-05-12
7.5
 None Remote Low Not required Partial Partial Partial
Tobesoft Xplatform 9.2.2.250 and earlier version have an arbitrary code execution vulnerability by using method supported by Xplatform ActiveX Control. It allows attacker to cause remote code execution.
479 CVE-2020-7805 78 Exec Code 2020-05-07 2020-05-14
10.0
 None Remote Low Not required Complete Complete Complete
An issue was discovered on KT Slim egg IML500 (R7283, R8112, R8424) and IML520 (R8112, R8368, R8411) wifi device. This issue is a command injection allowing attackers to execute arbitrary OS commands.
480 CVE-2020-7803 Exec Code 2020-05-07 2020-08-06
6.8
 None Remote Medium Not required Partial Partial Partial
IMGTech Co,Ltd ZInsX.ocx ActiveX Control in Zoneplayer 2.0.1.3, version 2.0.1.4 and prior versions on Windows. File Donwload vulnerability in ZInsX.ocx of IMGTech Co,Ltd Zoneplayer allows attacker to cause arbitrary code execution.
481 CVE-2020-7658 444 2020-05-22 2020-05-28
4.3
 None Remote Medium Not required None Partial None
meinheld prior to 1.0.2 is vulnerable to HTTP Request Smuggling. HTTP pipelining issues and request smuggling attacks might be possible due to incorrect Content-Length and Transfer encoding header parsing.
482 CVE-2020-7656 79 XSS 2020-05-19 2020-05-28
4.3
 None Remote Medium Not required None Partial None
jquery prior to 1.9.0 allows Cross-site Scripting attacks via the load method. The load method fails to recognize and remove "<script>" HTML tags that contain a whitespace character, i.e: "</script >", which results in the enclosed script logic to be executed.
483 CVE-2020-7655 444 2020-05-21 2020-05-21
4.3
 None Remote Medium Not required None Partial None
netius prior to 1.17.58 is vulnerable to HTTP Request Smuggling. HTTP pipelining issues and request smuggling attacks might be possible due to incorrect Transfer encoding header parsing which could allow for CL:TE or TE:TE attacks.
484 CVE-2020-7654 200 +Info 2020-05-29 2021-07-21
4.3
 None Remote Medium Not required Partial None None
All versions of snyk-broker before 4.73.1 are vulnerable to Information Exposure. It logs private keys if logging level is set to DEBUG.
485 CVE-2020-7653 200 +Info 2020-05-29 2021-07-21
4.0
 None Remote Low ??? Partial None None
All versions of snyk-broker before 4.80.0 are vulnerable to Arbitrary File Read. It allows arbitrary file reads for users with access to Snyk's internal network by creating symlinks to match whitelisted paths.
486 CVE-2020-7652 22 Dir. Trav. 2020-05-29 2020-06-02
4.0
 None Remote Low ??? Partial None None
All versions of snyk-broker before 4.80.0 are vulnerable to Arbitrary File Read. It allows arbitrary file reads for users with access to Snyk's internal network via directory traversal.
487 CVE-2020-7651 200 +Info 2020-05-29 2021-07-21
4.0
 None Remote Low ??? Partial None None
All versions of snyk-broker before 4.79.0 are vulnerable to Arbitrary File Read. It allows partial file reads for users who have access to Snyk's internal network via patch history from GitHub Commits API.
488 CVE-2020-7650 200 +Info 2020-05-29 2021-07-21
4.0
 None Remote Low ??? Partial None None
All versions of snyk-broker after 4.72.0 including and before 4.73.1 are vulnerable to Arbitrary File Read. It allows arbitrary file reads to users with access to Snyk's internal network of any files ending in the following extensions: yaml, yml or json.
489 CVE-2020-7648 200 +Info 2020-05-29 2021-07-21
4.0
 None Remote Low ??? Partial None None
All versions of snyk-broker before 4.72.2 are vulnerable to Arbitrary File Read. It allows arbitrary file reads for users who have access to Snyk's internal network by appending the URL with a fragment identifier and a whitelisted path e.g. `#package.json`
490 CVE-2020-7647 22 Dir. Trav. 2020-05-11 2020-05-14
5.0
 None Remote Low Not required Partial None None
All versions before 1.6.7 and all versions after 2.0.0 inclusive and before 2.8.2 of io.jooby:jooby and org.jooby:jooby are vulnerable to Directory Traversal via two separate vectors.
491 CVE-2020-7646 78 2020-05-07 2020-06-09
7.5
 None Remote Low Not required Partial Partial Partial
curlrequest through 1.0.1 allows reading any file by populating the file parameter with user input.
492 CVE-2020-7645 78 Exec Code 2020-05-02 2020-05-07
7.5
 None Remote Low Not required Partial Partial Partial
All versions of chrome-launcher allow execution of arbitrary commands, by controlling the $HOME environment variable in Linux operating systems.
493 CVE-2020-7473 22 Dir. Trav. 2020-05-07 2020-05-12
5.0
 None Remote Low Not required Partial None None
In certain situations, all versions of Citrix ShareFile StorageZones (aka storage zones) Controller, including the most recent 5.10.x releases as of May 2020, allow unauthenticated attackers to access the documents and folders of ShareFile users. NOTE: unlike most CVEs, exploitability depends on the product version that was in use when a particular setup step was performed, NOT the product version that is in use during a current assessment of a CVE consumer's product inventory. Specifically, the vulnerability can be exploited if a storage zone was created by one of these product versions: 5.9.0, 5.8.0, 5.7.0, 5.6.0, 5.5.0, or earlier. This CVE differs from CVE-2020-8982 and CVE-2020-8983 but has essentially the same risk.
494 CVE-2020-7455 772 2020-05-13 2020-05-19
5.0
 None Remote Low Not required Partial None None
In FreeBSD 12.1-STABLE before r360973, 12.1-RELEASE before p5, 11.4-STABLE before r360973, 11.4-BETA1 before p1 and 11.3-RELEASE before p9, the FTP packet handler in libalias incorrectly calculates some packet length allowing disclosure of small amounts of kernel (for kernel NAT) or natd process space (for userspace natd).
495 CVE-2020-7454 20 2020-05-13 2022-04-26
7.5
 None Remote Low Not required Partial Partial Partial
In FreeBSD 12.1-STABLE before r360971, 12.1-RELEASE before p5, 11.4-STABLE before r360971, 11.4-BETA1 before p1 and 11.3-RELEASE before p9, libalias does not properly validate packet length resulting in modules causing an out of bounds read/write condition if no checking was built into the module.
496 CVE-2020-7351 78 Exec Code 2020-05-01 2022-04-18
9.0
 None Remote Low ??? Complete Complete Complete
An OS Command Injection vulnerability in the endpoint_devicemap.php component of Fonality Trixbox Community Edition allows an attacker to execute commands on the underlying operating system as the "asterisk" user. Note that Trixbox Community Edition has been unsupported by the vendor since 2012. This issue affects: Fonality Trixbox Community Edition, versions 1.2.0 through 2.8.0.4. Versions 1.0 and 1.1 are unaffected.
497 CVE-2020-7291 269 2020-05-08 2021-09-08
4.6
 None Local Low Not required Partial Partial Partial
Privilege Escalation vulnerability in McAfee Active Response (MAR) for Mac prior to 2.4.3 Hotfix 1 allows a malicious script or program to perform functions that the local executing user has not been granted access to.
498 CVE-2020-7290 269 2020-05-08 2020-05-11
4.6
 None Local Low Not required Partial Partial Partial
Privilege Escalation vulnerability in McAfee Active Response (MAR) for Linux prior to 2.4.3 Hotfix 1 allows a malicious script or program to perform functions that the local executing user has not been granted access to.
499 CVE-2020-7289 269 2020-05-08 2020-05-11
4.6
 None Local Low Not required Partial Partial Partial
Privilege Escalation vulnerability in McAfee Active Response (MAR) for Windows prior to 2.4.3 Hotfix 1 allows a malicious script or program to perform functions that the local executing user has not been granted access to.
500 CVE-2020-7288 269 2020-05-08 2021-09-08
4.6
 None Local Low Not required Partial Partial Partial
Privilege Escalation vulnerability in McAfee Exploit Detection and Response (EDR) for Mac prior to 3.1.0 Hotfix 1 allows a malicious script or program to perform functions that the local executing user has not been granted access to.
Total number of vulnerabilities : 1017   Page : 1 2 3 4 5 6 7 8 9 10 (This Page)11 12 13 14 15 16 17 18 19 20 21
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.