CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
  Take a third party risk management course for FREE
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Security Vulnerabilities Published In May 2020

CVSS Scores Greater Than: 0   1   2   3   4   5   6   7   8   9  
Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
951 CVE-2019-19517 352 Bypass CSRF 2020-05-05 2020-05-07
6.8
 None Remote Medium Not required Partial Partial Partial
Intelbras RF1200 1.1.3 devices allow CSRF to bypass the login.html form, as demonstrated by launching a scrapy process.
952 CVE-2019-19515 79 XSS 2020-05-05 2020-05-07
4.3
 None Remote Medium Not required None Partial None
Ayision Ays-WR01 v28K.RPT.20161224 devices allow stored XSS in wireless settings.
953 CVE-2019-19514 79 XSS 2020-05-05 2020-05-07
3.5
 None Remote Medium ??? None Partial None
Ayision Ays-WR01 v28K.RPT.20161224 devices allow stored XSS in basic repeater settings via an SSID.
954 CVE-2019-19456 79 XSS 2020-05-18 2020-09-30
4.3
 None Remote Medium Not required None Partial None
A Reflected XSS was found in the server selection box inside the login page at: enginemanager/loginfailed.html in Wowza Streaming Engine <= 4.x.x. This issue was resolved in Wowza Streaming Engine 4.8.0.
955 CVE-2019-19454 2020-05-18 2020-09-30
5.0
 None Remote Low Not required Partial None None
An arbitrary file download was found in the "Download Log" functionality of Wowza Streaming Engine <= 4.x.x. This issue was resolved in Wowza Streaming Engine 4.8.0.
956 CVE-2019-19169 Exec Code 2020-05-06 2020-05-19
7.5
 None Remote Low Not required Partial Partial Partial
Dext5.ocx ActiveX 5.0.0.116 and eariler versions contain a vulnerability, which could allow remote attacker to download arbitrary file by setting the arguments to the activex method. This can be leveraged for code execution.
957 CVE-2019-19168 Exec Code 2020-05-06 2020-05-19
7.5
 None Remote Low Not required Partial Partial Partial
Dext5.ocx ActiveX 5.0.0.116 and eariler versions contain a vulnerability, which could allow remote attacker to download and execute remote arbitrary file by setting the arguments to the activex method. This can be leveraged for code execution.
958 CVE-2019-19167 Exec Code 2020-05-06 2020-05-11
7.5
 None Remote Low Not required Partial Partial Partial
Tobesoft Nexacro v2019.9.25.1 and earlier version have an arbitrary code execution vulnerability by using method supported by Nexacro14 ActiveX Control. It allows attacker to cause remote code execution.
959 CVE-2019-19166 Exec Code 2020-05-06 2020-05-07
4.4
 None Local Medium Not required Partial Partial Partial
Tobesoft XPlatform v9.1, 9.2.0, 9.2.1 and 9.2.2 have a vulnerability that can load unauthorized DLL files. It allows attacker to cause remote code execution.
960 CVE-2019-19164 Exec Code 2020-05-07 2021-10-29
6.8
 None Remote Medium Not required Partial Partial Partial
dext5.ocx ActiveX Control in Dext5 Upload 5.0.0.112 and earlier versions contains a vulnerability that could allow remote files to be executed by setting the arguments to the activex method. A remote attacker could induce a user to access a crafted web page, causing damage such as malicious code infection.
961 CVE-2019-19162 416 Exec Code 2020-05-11 2020-05-14
6.8
 None Remote Medium Not required Partial Partial Partial
A use-after-free vulnerability in the TOBESOFT XPLATFORM versions 9.1 to 9.2.2 may lead to code execution on a system running it.
962 CVE-2019-18872 521 2020-05-07 2020-05-12
5.0
 None Remote Low Not required None Partial None
Weak password requirements in Blaauw Remote Kiln Control through v3.00r4 allow a user to set short or guessable passwords (e.g., 1 or 1234).
963 CVE-2019-18871 22 Exec Code Dir. Trav. 2020-05-07 2020-05-12
6.5
 None Remote Low ??? Partial Partial Partial
A path traversal in debug.php accessed via default.php in Blaauw Remote Kiln Control through v3.00r4 allows an authenticated attacker to upload arbitrary files, leading to arbitrary remote code execution.
964 CVE-2019-18870 22 Dir. Trav. 2020-05-07 2020-05-12
4.0
 None Remote Low ??? Partial None None
A path traversal via the iniFile parameter in excel.php in Blaauw Remote Kiln Control through v3.00r4 allows an authenticated attacker to download arbitrary files from the host machine.
965 CVE-2019-18869 Exec Code 2020-05-07 2020-05-12
7.5
 None Remote Low Not required Partial Partial Partial
Leftover Debug Code in Blaauw Remote Kiln Control through v3.00r4 allows a user to execute arbitrary php code via /default.php?idx=17.
966 CVE-2019-18868 522 2020-05-07 2021-07-21
5.0
 None Remote Low Not required Partial None None
Blaauw Remote Kiln Control through v3.00r4 allows an unauthenticated attacker to access MySQL credentials in cleartext in /engine/db.inc, /lang/nl.bak, or /lang/en.bak.
967 CVE-2019-18867 200 +Info 2020-05-07 2020-05-12
5.0
 None Remote Low Not required Partial None None
Browsable directories in Blaauw Remote Kiln Control through v3.00r4 allow an attacker to enumerate sensitive filenames and locations, including source code. This affects /ajax/, /common/, /engine/, /flash/, /images/, /Images/, /jscripts/, /lang/, /layout/, /programs/, and /sms/.
968 CVE-2019-18866 89 Sql 2020-05-07 2020-05-15
5.0
 None Remote Low Not required Partial None None
Unauthenticated SQL injection via the username in the login mechanism in Blaauw Remote Kiln Control through v3.00r4 allows a user to extract arbitrary data from the rkc database.
969 CVE-2019-18865 200 +Info 2020-05-07 2021-07-21
5.0
 None Remote Low Not required Partial None None
Information disclosure via error message discrepancies in authentication functions in Blaauw Remote Kiln Control through v3.00r4 allows an unauthenticated attacker to enumerate valid usernames.
970 CVE-2019-18864 200 +Info 2020-05-07 2021-07-21
5.0
 None Remote Low Not required Partial None None
/server-info and /server-status in Blaauw Remote Kiln Control through v3.00r4 allow an unauthenticated attacker to gain sensitive information about the host machine.
971 CVE-2019-18666 862 2020-05-15 2021-07-21
10.0
 None Remote Low Not required Complete Complete Complete
An issue was discovered on D-Link DAP-1360 revision F devices. Remote attackers can start a telnet service without authorization via an undocumented HTTP request. Although this is the primary vulnerability, the impact depends on the firmware version. Versions 609EU through 613EUbeta were tested. Versions through 6.12b01 have weak root credentials, allowing an attacker to gain remote root access. After 6.12b01, the root credentials were changed but the telnet service can still be started without authorization.
972 CVE-2019-17572 22 Dir. Trav. 2020-05-14 2020-05-15
5.0
 None Remote Low Not required Partial None None
In Apache RocketMQ 4.2.0 to 4.6.0, when the automatic topic creation in the broker is turned on by default, an evil topic like “../../../../topic2020” is sent from rocketmq-client to the broker, a topic folder will be created in the parent directory in brokers, which leads to a directory traversal vulnerability. Users of the affected versions should apply one of the following: Upgrade to Apache RocketMQ 4.6.1 or later.
973 CVE-2019-17562 20 Overflow 2020-05-14 2021-07-21
7.5
 None Remote Low Not required Partial Partial Partial
A buffer overflow vulnerability has been found in the baremetal component of Apache CloudStack. This applies to all versions prior to 4.13.1. The vulnerability is due to the lack of validation of the mac parameter in baremetal virtual router. If you insert an arbitrary shell command into the mac parameter, v-router will process the command. For example: Normal: http://{GW}:10086/baremetal/provisiondone/{mac}, Abnormal: http://{GW}:10086/baremetal/provisiondone/#';whoami;#. Mitigation of this issue is an upgrade to Apache CloudStack 4.13.1.0 or beyond.
974 CVE-2019-17557 79 Exec Code XSS 2020-05-04 2020-05-07
3.5
 None Remote Medium ??? None Partial None
It was found that the Apache Syncope EndUser UI login page prio to 2.0.15 and 2.1.6 reflects the successMessage parameters. By this mean, a user accessing the Enduser UI could execute javascript code from URL query string.
975 CVE-2019-17066 269 2020-05-18 2020-05-20
7.2
 None Local Low Not required Complete Complete Complete
In Ivanti WorkSpace Control before 10.4.40.0, a user can elevate rights on the system by hijacking certain user registries. This is possible because pwrgrid.exe first checks the Current User registry hives (HKCU) when starting an application with elevated rights.
976 CVE-2019-16112 502 Exec Code 2020-05-13 2020-05-15
6.5
 None Remote Low ??? Partial Partial Partial
TylerTech Eagle 2018.3.11 deserializes untrusted user input, resulting in remote code execution via a crafted Java object to the recorder/ServiceManager?service=tyler.empire.settings.SettingManager URI.
977 CVE-2019-15880 119 Overflow 2020-05-13 2022-04-26
7.5
 None Remote Low Not required Partial Partial Partial
In FreeBSD 12.1-STABLE before r356911, and 12.1-RELEASE before p5, insufficient checking in the cryptodev module allocated the size of a kernel buffer based on a user-supplied length allowing an unprivileged process to trigger a kernel panic.
978 CVE-2019-15879 362 2020-05-13 2020-05-18
5.8
 None Remote Medium Not required None Partial Partial
In FreeBSD 12.1-STABLE before r356908, 12.1-RELEASE before p5, 11.3-STABLE before r356908, and 11.3-RELEASE before p9, a race condition in the cryptodev module permitted a data structure in the kernel to be used after it was freed, allowing an unprivileged process can overwrite arbitrary kernel memory.
979 CVE-2019-15878 416 2020-05-13 2020-05-18
4.6
 None Local Low Not required Partial Partial Partial
In FreeBSD 12.1-STABLE before r352509, 11.3-STABLE before r352509, and 11.3-RELEASE before p9, an unprivileged local user can trigger a use-after-free situation due to improper checking in SCTP when an application tries to update an SCTP-AUTH shared key.
980 CVE-2019-15083 79 Exec Code XSS 2020-05-14 2020-05-19
4.3
 None Remote Medium Not required None Partial None
Default installations of Zoho ManageEngine ServiceDesk Plus 10.0 before 10500 are vulnerable to XSS injected by a workstation local administrator. Using the installed program names of the computer as a vector, the local administrator can execute code on the Manage Engine ServiceDesk administrator side. At "Asset Home > Server > <workstation> > software" the administrator of ManageEngine can control what software is installed on the workstation. This table shows all the installed program names in the Software column. In this field, a remote attacker can inject malicious code in order to execute it when the ManageEngine administrator visualizes this page.
981 CVE-2019-14898 362 DoS +Info 2020-05-08 2021-06-14
6.9
 None Local Medium Not required Complete Complete Complete
The fix for CVE-2019-11599, affecting the Linux kernel before 5.0.10 was not complete. A local user could use this flaw to obtain sensitive information, cause a denial of service, or possibly have other unspecified impacts by triggering a race condition with mmget_not_zero or get_task_mm calls.
982 CVE-2019-13285 74 2020-05-04 2020-05-11
5.0
 None Remote Low Not required None Partial None
CoSoSys Endpoint Protector 5.1.0.2 allows Host Header Injection.
983 CVE-2019-13023 522 2020-05-14 2021-07-21
4.0
 None Remote Low ??? Partial None None
An issue was discovered in all versions of Bond JetSelect. Within the JetSelect Application, the web interface hides RADIUS secrets, WPA passwords, and SNMP strings from 'non administrative' users using HTML 'password field' obfuscation. By using Developer tools or similar, it is possible to change the obfuscation so that the credentials are visible.
984 CVE-2019-13022 522 2020-05-14 2021-07-21
10.0
 None Remote Low Not required Complete Complete Complete
Bond JetSelect (all versions) has an issue in the Java class (ENCtool.jar) and corresponding password generation algorithm (used to set initial passwords upon first installation). It XORs the plaintext into the 'encrypted' password that is then stored within the database. These steps are able to be trivially reversed, allowing for escalation of privilege within the JetSelect application through obtaining the passwords of JetSelect administrators. JetSelect administrators have the ability to modify and delete all networking configuration across a vessel, as well as altering network configuration of all managed network devices (switches, routers).
985 CVE-2019-13021 522 2020-05-14 2021-07-21
4.0
 None Remote Low ??? Partial None None
The administrative passwords for all versions of Bond JetSelect are stored within an unprotected file on the filesystem, rather than encrypted within the MySQL database. This backup copy of the passwords is made as part of the installation script, after the administrator has generated a password using ENCtool.jar (see CVE-2019-13022). This allows any low-privilege user who can read this file to trivially obtain the passwords for the administrative accounts of the JetSelect application. The path to the file containing the encoded password hash is /opt/JetSelect/SFC/resources/sfc-general-properties.
986 CVE-2019-12864 200 +Info 2020-05-04 2021-07-21
2.1
 None Local Low Not required Partial None None
SolarWinds Orion Platform 2018.4 HF3 (NPM 12.4, NetPath 1.1.4) is vulnerable to Information Leakage, because of improper error handling with stack traces, as demonstrated by discovering a full pathname upon a 500 Internal Server Error via the api2/swis/query?lang=en-us&swAlertOnError=false query parameter.
987 CVE-2019-11823 125 DoS 2020-05-04 2021-05-12
5.0
 None Remote Low Not required None None Partial
CRLF injection vulnerability in Network Center in Synology Router Manager (SRM) before 1.2.3-8017-2 allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via crafted network traffic.
988 CVE-2019-11048 190 2020-05-20 2021-07-22
5.0
 None Remote Low Not required None None Partial
In PHP versions 7.2.x below 7.2.31, 7.3.x below 7.3.18 and 7.4.x below 7.4.6, when HTTP file uploads are allowed, supplying overly long filenames or field names could lead PHP engine to try to allocate oversized memory storage, hit the memory limit and stop processing the request, without cleaning up temporary files created by upload request. This potentially could lead to accumulation of uncleaned temporary files exhausting the disk space on the target server.
989 CVE-2019-10170 Exec Code 2020-05-08 2021-10-19
6.5
 None Remote Low ??? Partial Partial Partial
A flaw was found in the Keycloak admin console, where the realm management interface permits a script to be set via the policy. This flaw allows an attacker with authenticated user and realm management permissions to configure a malicious script to trigger and execute arbitrary code with the permissions of the application user.
990 CVE-2019-10169 Exec Code 2020-05-08 2021-10-19
6.5
 None Remote Low ??? Partial Partial Partial
A flaw was found in Keycloak’s user-managed access interface, where it would permit a script to be set in the UMA policy. This flaw allows an authenticated attacker with UMA permissions to configure a malicious script to trigger and execute arbitrary code with the permissions of the user running application.
991 CVE-2019-9682 276 2020-05-13 2020-05-18
6.8
 None Remote Medium Not required Partial Partial Partial
Dahua devices with Build time before December 2019 use strong security login mode by default, but in order to be compatible with the normal login of early devices, some devices retain the weak security login mode that users can control. If the user uses a weak security login method, an attacker can monitor the device network to intercept network packets to attack the device. So it is recommended that the user disable this login method.
992 CVE-2019-7247 732 Exec Code 2020-05-18 2021-07-21
7.5
 None Remote Low Not required Partial Partial Partial
An issue was discovered in AODDriver2.sys in AMD OverDrive. The vulnerable driver exposes a wrmsr instruction via IOCTL 0x81112ee0 and does not properly filter the Model Specific Register (MSR). Allowing arbitrary MSR writes can lead to Ring-0 code execution and escalation of privileges.
993 CVE-2019-7246 732 Exec Code 2020-05-18 2021-07-21
4.6
 None Local Low Not required Partial Partial Partial
An issue was discovered in atillk64.sys in AMD ATI Diagnostics Hardware Abstraction Sys/Overclocking Utility 5.11.9.0. The vulnerable driver exposes a wrmsr instruction and does not properly filter the Model Specific Register (MSR). Allowing arbitrary MSR writes can lead to Ring-0 code execution and escalation of privileges.
994 CVE-2019-6342 20 Bypass 2020-05-28 2021-07-21
6.8
 None Remote Medium Not required Partial Partial Partial
An access bypass vulnerability exists when the experimental Workspaces module in Drupal 8 core is enabled. This can be mitigated by disabling the Workspaces module. It does not affect any release other than Drupal 8.7.4.
995 CVE-2019-5997 94 2020-05-20 2020-05-20
7.5
 None Remote Low Not required Partial Partial Partial
Video Insight VMS 7.5 and earlier allows remote attackers to conduct code injection attacks via unspecified vectors.
996 CVE-2019-5500 DoS 2020-05-11 2020-05-14
5.0
 None Remote Low Not required None None Partial
Certain versions of the NetApp Service Processor and Baseboard Management Controller firmware allow a remote unauthenticated attacker to cause a Denial of Service (DoS).
997 CVE-2019-4667 200 +Info 2020-05-11 2021-07-21
4.3
 None Remote Medium Not required Partial None None
IBM UrbanCode Deploy (UCD) 7.0.5.2 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques. IBM X-Force ID: 171249.
998 CVE-2019-4478 200 +Info 2020-05-12 2021-07-21
4.0
 None Remote Low ??? Partial None None
IBM Maximo Asset Management 7.6.0, and 7.6.1 could allow an authenticated user to obtain highly sensitive information that they should not normally have access to. IBM X-Force ID: 163998.
999 CVE-2019-4266 269 2020-05-06 2020-05-08
2.1
 None Local Low Not required Partial None None
IBM Maximo Anywhere 7.6.2.0, 7.6.2.1, 7.6.3.0, and 7.6.3.1 does not have device jailbreak detection which could result in an attacker gaining sensitive information about the device. IBM X-Force ID: 160199.
1000 CVE-2019-4209 601 2020-05-01 2020-05-05
5.8
 None Remote Medium Not required Partial Partial None
HCL Connections v5.5, v6.0, and v6.5 contains an open redirect vulnerability which could be exploited by an attacker to conduct phishing attacks.
Total number of vulnerabilities : 1017   Page : 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 (This Page)21
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.