# CVEs published 2020-08-05 26 CVEs were published on August 5, 2020: 0 critical, 3 high. Days are UTC. - [CVE-2020-9036](https://cve.now/CVE-2020-9036.md): Jeedom through 4.0.38 allows XSS. (no CVSS) - [CVE-2020-17366](https://cve.now/CVE-2020-17366.md): An issue was discovered in NLnet Labs Routinator 0.1.0 through 0.7.1. (no CVSS) - [CVE-2020-13404](https://cve.now/CVE-2020-13404.md): The ATOS/Sips (aka Atos-Magento) community module 3.0.0 to 3.0.5 for Magento allows command injection. (no CVSS) - [CVE-2020-7298](https://cve.now/CVE-2020-7298.md): Total Protection (MTP) - Unexpected behavior violation (CVSS 7.5, McAfee Total Protection) - [CVE-2020-15132](https://cve.now/CVE-2020-15132.md): Reset Password / Login vulnerability in Sulu (CVSS 5.3, sulu · sulu/sulu) - [CVE-2020-15127](https://cve.now/CVE-2020-15127.md): Denial of service in Contour (CVSS 7.5, projectcontour contour) - [CVE-2020-15112](https://cve.now/CVE-2020-15112.md): Improper Input Validation in etcd (CVSS 6.5, etcd-io etcd · go.etcd.io/etcd/v3 +1) - [CVE-2020-16254](https://cve.now/CVE-2020-16254.md): The Chartkick gem through 3.3.2 for Ruby allows Cascading Style Sheets (CSS) Injection (without attribute). (no CVSS, chartkick) - [CVE-2020-15113](https://cve.now/CVE-2020-15113.md): Improper Preservation of Permissions in etcd (CVSS 5.7, etcd-io etcd · github.com/etcd-io/etcd) - [CVE-2020-15106](https://cve.now/CVE-2020-15106.md): Improper Input Validation in etcd (CVSS 6.5, etcd-io etcd · go.etcd.io/etcd/v3 +1) - [CVE-2020-16192](https://cve.now/CVE-2020-16192.md): LimeSurvey 4.3.2 allows reflected XSS because application/controllers/LSBaseController.php lacks code to validate parameters. (no CVSS) - [CVE-2020-17364](https://cve.now/CVE-2020-17364.md): USVN (aka User-friendly SVN) before 1.0.9 allows XSS via SVN logs. (no CVSS) - [CVE-2020-8607](https://cve.now/CVE-2020-8607.md): An input validation vulnerability found in multiple Trend Micro products utilizing a particular version of a specific rootkit protection… (no CVSS, Trend Micro Apex One · Trend Micro OfficeScan +9) - [CVE-2020-16253](https://cve.now/CVE-2020-16253.md): The PgHero gem through 2.6.0 for Ruby allows CSRF. (no CVSS, pghero) - [CVE-2020-16252](https://cve.now/CVE-2020-16252.md): The Field Test gem 0.2.0 through 0.3.2 for Ruby allows CSRF. (no CVSS, field\_test) - [CVE-2020-13819](https://cve.now/CVE-2020-13819.md): Extreme EAC Appliance 8.4.1.24 allows unauthenticated reflected XSS via a parameter in a GET request. (no CVSS) - [CVE-2020-13921](https://cve.now/CVE-2020-13921.md): Resolved Only when using H2/MySQL/TiDB as Apache SkyWalking storage, there is a SQL injection vulnerability in the wildcard query cases. (no CVSS, Apache SkyWalking · apache-skywalking +1) - [CVE-2020-4481](https://cve.now/CVE-2020-4481.md): IBM UrbanCode Deploy (UCD) 6.2.7.3, 6.2.7.4, 7.0.3.0, and 7.0.4.0 is vulnerable to an XML External Entity Injection (XXE) attack when… (CVSS 8.2, IBM UrbanCode Deploy) - [CVE-2020-4243](https://cve.now/CVE-2020-4243.md): IBM Security Identity Governance and Intelligence 5.2.6 Virtual Appliance could allow a remote attacker to obtain sensitive information… (CVSS 3.7, IBM Security Identity Governance and Intelligence) - [CVE-2020-5608](https://cve.now/CVE-2020-5608.md): CAMS for HIS CENTUM CS 3000 (includes CENTUM CS 3000 Small) R3.08.10 to R3.09.50, CENTUM VP (includes CENTUM VP Small, Basic) R4.01.00 to… (no CVSS, Yokogawa Electric CAMS for HIS) - [CVE-2020-5609](https://cve.now/CVE-2020-5609.md): Directory traversal vulnerability in CAMS for HIS CENTUM CS 3000 (includes CENTUM CS 3000 Small) R3.08.10 to R3.09.50, CENTUM VP (includes… (no CVSS, Yokogawa Electric CAMS for HIS) - [CVE-2020-14347](https://cve.now/CVE-2020-14347.md): A flaw was found in the way xserver memory was not properly initialized. (CVSS 5.5, The Xorg Project xorg-x11-server) - [CVE-2020-14344](https://cve.now/CVE-2020-14344.md): An integer overflow leading to a heap-buffer overflow was found in The X Input Method (XIM) client was implemented in libX11 before… (CVSS 6.7, The X11 Project libX11) - [CVE-2020-17353](https://cve.now/CVE-2020-17353.md): scm/define-stencil-commands.scm in LilyPond through 2.20.0, and 2.21.x through 2.21.4, when -dsafe is used, lacks restrictions on… (no CVSS) - [CVE-2020-13151](https://cve.now/CVE-2020-13151.md): Aerospike Community Edition 4.9.0.5 allows for unauthenticated submission and execution of user-defined functions (UDFs), written in Lua… (no CVSS) - [CVE-2017-18112](https://cve.now/CVE-2017-18112.md): Affected versions of Atlassian Fisheye allow remote attackers to view the HTTP password of a repository via an Information Disclosure… (no CVSS, Atlassian Fisheye) --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/archive/2020-08-05 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.