CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
  Take a third party risk management course for FREE
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Security Vulnerabilities Published In May 2020 (CVSS score >= 5)

Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
551 CVE-2019-19167 Exec Code 2020-05-06 2020-05-11
7.5
None Remote Low Not required Partial Partial Partial
Tobesoft Nexacro v2019.9.25.1 and earlier version have an arbitrary code execution vulnerability by using method supported by Nexacro14 ActiveX Control. It allows attacker to cause remote code execution.
552 CVE-2019-19164 Exec Code 2020-05-07 2021-10-29
6.8
None Remote Medium Not required Partial Partial Partial
dext5.ocx ActiveX Control in Dext5 Upload 5.0.0.112 and earlier versions contains a vulnerability that could allow remote files to be executed by setting the arguments to the activex method. A remote attacker could induce a user to access a crafted web page, causing damage such as malicious code infection.
553 CVE-2019-19162 416 Exec Code 2020-05-11 2020-05-14
6.8
None Remote Medium Not required Partial Partial Partial
A use-after-free vulnerability in the TOBESOFT XPLATFORM versions 9.1 to 9.2.2 may lead to code execution on a system running it.
554 CVE-2019-18872 521 2020-05-07 2020-05-12
5.0
None Remote Low Not required None Partial None
Weak password requirements in Blaauw Remote Kiln Control through v3.00r4 allow a user to set short or guessable passwords (e.g., 1 or 1234).
555 CVE-2019-18871 22 Exec Code Dir. Trav. 2020-05-07 2020-05-12
6.5
None Remote Low ??? Partial Partial Partial
A path traversal in debug.php accessed via default.php in Blaauw Remote Kiln Control through v3.00r4 allows an authenticated attacker to upload arbitrary files, leading to arbitrary remote code execution.
556 CVE-2019-18869 Exec Code 2020-05-07 2020-05-12
7.5
None Remote Low Not required Partial Partial Partial
Leftover Debug Code in Blaauw Remote Kiln Control through v3.00r4 allows a user to execute arbitrary php code via /default.php?idx=17.
557 CVE-2019-18868 522 2020-05-07 2021-07-21
5.0
None Remote Low Not required Partial None None
Blaauw Remote Kiln Control through v3.00r4 allows an unauthenticated attacker to access MySQL credentials in cleartext in /engine/db.inc, /lang/nl.bak, or /lang/en.bak.
558 CVE-2019-18867 200 +Info 2020-05-07 2020-05-12
5.0
None Remote Low Not required Partial None None
Browsable directories in Blaauw Remote Kiln Control through v3.00r4 allow an attacker to enumerate sensitive filenames and locations, including source code. This affects /ajax/, /common/, /engine/, /flash/, /images/, /Images/, /jscripts/, /lang/, /layout/, /programs/, and /sms/.
559 CVE-2019-18866 89 Sql 2020-05-07 2020-05-15
5.0
None Remote Low Not required Partial None None
Unauthenticated SQL injection via the username in the login mechanism in Blaauw Remote Kiln Control through v3.00r4 allows a user to extract arbitrary data from the rkc database.
560 CVE-2019-18865 200 +Info 2020-05-07 2021-07-21
5.0
None Remote Low Not required Partial None None
Information disclosure via error message discrepancies in authentication functions in Blaauw Remote Kiln Control through v3.00r4 allows an unauthenticated attacker to enumerate valid usernames.
561 CVE-2019-18864 200 +Info 2020-05-07 2021-07-21
5.0
None Remote Low Not required Partial None None
/server-info and /server-status in Blaauw Remote Kiln Control through v3.00r4 allow an unauthenticated attacker to gain sensitive information about the host machine.
562 CVE-2019-18666 862 2020-05-15 2021-07-21
10.0
None Remote Low Not required Complete Complete Complete
An issue was discovered on D-Link DAP-1360 revision F devices. Remote attackers can start a telnet service without authorization via an undocumented HTTP request. Although this is the primary vulnerability, the impact depends on the firmware version. Versions 609EU through 613EUbeta were tested. Versions through 6.12b01 have weak root credentials, allowing an attacker to gain remote root access. After 6.12b01, the root credentials were changed but the telnet service can still be started without authorization.
563 CVE-2019-17572 22 Dir. Trav. 2020-05-14 2020-05-15
5.0
None Remote Low Not required Partial None None
In Apache RocketMQ 4.2.0 to 4.6.0, when the automatic topic creation in the broker is turned on by default, an evil topic like “../../../../topic2020” is sent from rocketmq-client to the broker, a topic folder will be created in the parent directory in brokers, which leads to a directory traversal vulnerability. Users of the affected versions should apply one of the following: Upgrade to Apache RocketMQ 4.6.1 or later.
564 CVE-2019-17562 20 Overflow 2020-05-14 2021-07-21
7.5
None Remote Low Not required Partial Partial Partial
A buffer overflow vulnerability has been found in the baremetal component of Apache CloudStack. This applies to all versions prior to 4.13.1. The vulnerability is due to the lack of validation of the mac parameter in baremetal virtual router. If you insert an arbitrary shell command into the mac parameter, v-router will process the command. For example: Normal: http://{GW}:10086/baremetal/provisiondone/{mac}, Abnormal: http://{GW}:10086/baremetal/provisiondone/#';whoami;#. Mitigation of this issue is an upgrade to Apache CloudStack 4.13.1.0 or beyond.
565 CVE-2019-17066 269 2020-05-18 2020-05-20
7.2
None Local Low Not required Complete Complete Complete
In Ivanti WorkSpace Control before 10.4.40.0, a user can elevate rights on the system by hijacking certain user registries. This is possible because pwrgrid.exe first checks the Current User registry hives (HKCU) when starting an application with elevated rights.
566 CVE-2019-16112 502 Exec Code 2020-05-13 2020-05-15
6.5
None Remote Low ??? Partial Partial Partial
TylerTech Eagle 2018.3.11 deserializes untrusted user input, resulting in remote code execution via a crafted Java object to the recorder/ServiceManager?service=tyler.empire.settings.SettingManager URI.
567 CVE-2019-15880 119 Overflow 2020-05-13 2022-04-26
7.5
None Remote Low Not required Partial Partial Partial
In FreeBSD 12.1-STABLE before r356911, and 12.1-RELEASE before p5, insufficient checking in the cryptodev module allocated the size of a kernel buffer based on a user-supplied length allowing an unprivileged process to trigger a kernel panic.
568 CVE-2019-15879 362 2020-05-13 2020-05-18
5.8
None Remote Medium Not required None Partial Partial
In FreeBSD 12.1-STABLE before r356908, 12.1-RELEASE before p5, 11.3-STABLE before r356908, and 11.3-RELEASE before p9, a race condition in the cryptodev module permitted a data structure in the kernel to be used after it was freed, allowing an unprivileged process can overwrite arbitrary kernel memory.
569 CVE-2019-14898 362 DoS +Info 2020-05-08 2021-06-14
6.9
None Local Medium Not required Complete Complete Complete
The fix for CVE-2019-11599, affecting the Linux kernel before 5.0.10 was not complete. A local user could use this flaw to obtain sensitive information, cause a denial of service, or possibly have other unspecified impacts by triggering a race condition with mmget_not_zero or get_task_mm calls.
570 CVE-2019-13285 74 2020-05-04 2020-05-11
5.0
None Remote Low Not required None Partial None
CoSoSys Endpoint Protector 5.1.0.2 allows Host Header Injection.
571 CVE-2019-13022 522 2020-05-14 2021-07-21
10.0
None Remote Low Not required Complete Complete Complete
Bond JetSelect (all versions) has an issue in the Java class (ENCtool.jar) and corresponding password generation algorithm (used to set initial passwords upon first installation). It XORs the plaintext into the 'encrypted' password that is then stored within the database. These steps are able to be trivially reversed, allowing for escalation of privilege within the JetSelect application through obtaining the passwords of JetSelect administrators. JetSelect administrators have the ability to modify and delete all networking configuration across a vessel, as well as altering network configuration of all managed network devices (switches, routers).
572 CVE-2019-11823 125 DoS 2020-05-04 2021-05-12
5.0
None Remote Low Not required None None Partial
CRLF injection vulnerability in Network Center in Synology Router Manager (SRM) before 1.2.3-8017-2 allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via crafted network traffic.
573 CVE-2019-11048 190 2020-05-20 2021-07-22
5.0
None Remote Low Not required None None Partial
In PHP versions 7.2.x below 7.2.31, 7.3.x below 7.3.18 and 7.4.x below 7.4.6, when HTTP file uploads are allowed, supplying overly long filenames or field names could lead PHP engine to try to allocate oversized memory storage, hit the memory limit and stop processing the request, without cleaning up temporary files created by upload request. This potentially could lead to accumulation of uncleaned temporary files exhausting the disk space on the target server.
574 CVE-2019-10170 Exec Code 2020-05-08 2021-10-19
6.5
None Remote Low ??? Partial Partial Partial
A flaw was found in the Keycloak admin console, where the realm management interface permits a script to be set via the policy. This flaw allows an attacker with authenticated user and realm management permissions to configure a malicious script to trigger and execute arbitrary code with the permissions of the application user.
575 CVE-2019-10169 Exec Code 2020-05-08 2021-10-19
6.5
None Remote Low ??? Partial Partial Partial
A flaw was found in Keycloak’s user-managed access interface, where it would permit a script to be set in the UMA policy. This flaw allows an authenticated attacker with UMA permissions to configure a malicious script to trigger and execute arbitrary code with the permissions of the user running application.
576 CVE-2019-9682 276 2020-05-13 2020-05-18
6.8
None Remote Medium Not required Partial Partial Partial
Dahua devices with Build time before December 2019 use strong security login mode by default, but in order to be compatible with the normal login of early devices, some devices retain the weak security login mode that users can control. If the user uses a weak security login method, an attacker can monitor the device network to intercept network packets to attack the device. So it is recommended that the user disable this login method.
577 CVE-2019-7247 732 Exec Code 2020-05-18 2021-07-21
7.5
None Remote Low Not required Partial Partial Partial
An issue was discovered in AODDriver2.sys in AMD OverDrive. The vulnerable driver exposes a wrmsr instruction via IOCTL 0x81112ee0 and does not properly filter the Model Specific Register (MSR). Allowing arbitrary MSR writes can lead to Ring-0 code execution and escalation of privileges.
578 CVE-2019-6342 20 Bypass 2020-05-28 2021-07-21
6.8
None Remote Medium Not required Partial Partial Partial
An access bypass vulnerability exists when the experimental Workspaces module in Drupal 8 core is enabled. This can be mitigated by disabling the Workspaces module. It does not affect any release other than Drupal 8.7.4.
579 CVE-2019-5997 94 2020-05-20 2020-05-20
7.5
None Remote Low Not required Partial Partial Partial
Video Insight VMS 7.5 and earlier allows remote attackers to conduct code injection attacks via unspecified vectors.
580 CVE-2019-5500 DoS 2020-05-11 2020-05-14
5.0
None Remote Low Not required None None Partial
Certain versions of the NetApp Service Processor and Baseboard Management Controller firmware allow a remote unauthenticated attacker to cause a Denial of Service (DoS).
581 CVE-2019-4209 601 2020-05-01 2020-05-05
5.8
None Remote Medium Not required Partial Partial None
HCL Connections v5.5, v6.0, and v6.5 contains an open redirect vulnerability which could be exploited by an attacker to conduct phishing attacks.
582 CVE-2019-2388 425 2020-05-13 2020-05-18
5.0
None Remote Low Not required Partial None None
In affected Ops Manager versions there is an exposed http route was that may allow attackers to view a specific access log of a publicly exposed Ops Manager instance. This issue affects: MongoDB Inc. MongoDB Ops Manager 4.0 versions 4.0.9, 4.0.10 and MongoDB Ops Manager 4.1 version 4.1.5.
583 CVE-2018-21234 502 2020-05-21 2022-04-22
7.5
None Remote Low Not required Partial Partial Partial
Jodd before 5.0.4 performs Deserialization of Untrusted JSON Data when setClassMetadataName is set.
584 CVE-2018-20225 20 2020-05-08 2020-06-01
6.8
None Remote Medium Not required Partial Partial Partial
** DISPUTED ** An issue was discovered in pip (all versions) because it installs the version with the highest version number, even if the user had intended to obtain a private package from a private index. This only affects use of the --extra-index-url option, and exploitation requires that the package does not already exist in the public index (and thus the attacker can put the package there with an arbitrary version number). NOTE: it has been reported that this is intended functionality and the user is responsible for using --extra-index-url securely.
585 CVE-2018-10756 416 DoS Exec Code 2020-05-15 2020-08-14
6.8
None Remote Medium Not required Partial Partial Partial
Use-after-free in libtransmission/variant.c in Transmission before 3.00 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted torrent file.
586 CVE-2018-8956 20 2020-05-06 2020-07-19
5.0
None Remote Low Not required None None Partial
ntpd in ntp 4.2.8p10, 4.2.8p11, 4.2.8p12 and 4.2.8p13 allow remote attackers to prevent a broadcast client from synchronizing its clock with a broadcast NTP server via soofed mode 3 and mode 5 packets. The attacker must either be a part of the same broadcast network or control a slave in that broadcast network that can capture certain required packets on the attacker's behalf and send them to the attacker.
587 CVE-2018-5493 DoS 2020-05-07 2020-05-12
5.0
None Remote Low Not required None None Partial
ATTO FibreBridge 7500N firmware versions prior to 2.90 are susceptible to a vulnerability which allows an unauthenticated remote attacker to cause Denial of Service (DoS).
588 CVE-2018-1285 611 2020-05-11 2022-06-07
7.5
None Remote Low Not required Partial Partial Partial
Apache log4net versions before 2.0.10 do not disable XML external entities when parsing log4net configuration files. This allows for XXE-based attacks in applications that accept attacker-controlled log4net configuration files.
589 CVE-2017-18868 276 2020-05-21 2020-05-22
5.5
None Remote Low ??? None Partial Partial
Digi XBee 2 devices do not have an effective protection mechanism against remote AT commands, because of issues related to the network stack upon which the ZigBee protocol is built.
590 CVE-2017-18865 787 Overflow 2020-05-05 2020-05-06
5.2
None Local Network Low ??? Partial Partial Partial
Certain NETGEAR devices are affected by a stack-based buffer overflow by an authenticated user. This affects R8300 before 1.0.2.104 and R8500 before 1.0.2.104.
591 CVE-2017-18864 120 Overflow 2020-05-05 2020-05-08
5.8
None Local Network Low Not required Partial Partial Partial
Certain NETGEAR devices are affected by a buffer overflow by an unauthenticated attacker. This affects R6400 before 1.0.1.24, R6400v2 before 1.0.2.32, R6700 before 1.0.1.22, R6900 before 1.0.1.22, R7000 before 1.0.9.4, R7000P before 1.0.0.56, R6900P before 1.0.0.56, R7100LG before 1.0.0.32, R7300 before 1.0.0.54, R7900 before 1.0.1.18, R8300 before 1.0.2.104, and R8500 before 1.0.2.104.
Total number of vulnerabilities : 592   Page : 1 2 3 4 5 6 7 8 9 10 11 12 (This Page)
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.