# CVEs published 2020-05-27

28 CVEs were published on May 27, 2020: 2 critical, 2 high. Days are UTC.

- [CVE-2020-8606](https://cve.now/CVE-2020-8606.md): A vulnerability in Trend Micro InterScan Web Security Virtual Appliance 6.5 may allow remote attackers to bypass authentication on affected (no CVSS, Trend Micro InterScan Web Security Virtual Appliance)
- [CVE-2020-8604](https://cve.now/CVE-2020-8604.md): A vulnerability in Trend Micro InterScan Web Security Virtual Appliance 6.5 may allow remote attackers to disclose sensitive informatoin on (no CVSS, Trend Micro InterScan Web Security Virtual Appliance)
- [CVE-2020-8605](https://cve.now/CVE-2020-8605.md): A vulnerability in Trend Micro InterScan Web Security Virtual Appliance 6.5 may allow remote attackers to execute arbitrary code on affected (no CVSS, Trend Micro InterScan Web Security Virtual Appliance)
- [CVE-2020-8603](https://cve.now/CVE-2020-8603.md): A cross-site scripting vulnerability (XSS) in Trend Micro InterScan Web Security Virtual Appliance 6.5 may allow a remote attacker to tamper (no CVSS, Trend Micro InterScan Web Security Virtual Appliance)
- [CVE-2020-11075](https://cve.now/CVE-2020-11075.md): Shell Escape in Anchore Engine (CVSS 7.7, anchore-engine)
- [CVE-2020-11059](https://cve.now/CVE-2020-11059.md): Exposure of Sensitive Information to an Unauthorized Actor in AEgir (CVSS 9.6, IPFS AEgir · aegir)
- [CVE-2020-10936](https://cve.now/CVE-2020-10936.md): Sympa before 6.2.56 allows privilege escalation. (no CVSS)
- [CVE-2020-6774](https://cve.now/CVE-2020-6774.md): Kiosk Mode Breakout in Bosch Recording Station (CVSS 9.3, Bosch Recording Station)
- [CVE-2020-13628](https://cve.now/CVE-2020-13628.md): Cross-site scripting (XSS) vulnerability allows remote attackers to inject arbitrary web script or HTML via the widgetId parameter to host-m (no CVSS)
- [CVE-2020-13627](https://cve.now/CVE-2020-13627.md): Cross-site scripting (XSS) vulnerability allows remote attackers to inject arbitrary web script or HTML via the widgetId parameter to servic (no CVSS)
- [CVE-2020-10946](https://cve.now/CVE-2020-10946.md): Cross-site scripting (XSS) vulnerability allows remote attackers to inject arbitrary web script or HTML via the page parameter to service-mo (no CVSS)
- [CVE-2020-10945](https://cve.now/CVE-2020-10945.md): Centreon before 19.10.7 exposes Session IDs in server responses. (no CVSS, centreon/centreon)
- [CVE-2020-13633](https://cve.now/CVE-2020-13633.md): Fork before 5.8.3 allows XSS via navigation\_title or title. (no CVSS, forkcms/forkcms)
- [CVE-2020-13630](https://cve.now/CVE-2020-13630.md): ext/fts3/fts3.c in SQLite before 3.32.0 has a use-after-free in fts3EvalNextRow, related to the snippet feature. (no CVSS, sqlite)
- [CVE-2020-13631](https://cve.now/CVE-2020-13631.md): SQLite before 3.32.0 allows a virtual table to be renamed to the name of one of its shadow tables, related to alter.c and build.c. (no CVSS, sqlite)
- [CVE-2020-13632](https://cve.now/CVE-2020-13632.md): ext/fts3/fts3\_snippet.c in SQLite before 3.32.0 has a NULL pointer dereference via a crafted matchinfo() query. (no CVSS, sqlite)
- [CVE-2020-13253](https://cve.now/CVE-2020-13253.md): sd\_wp\_addr in hw/sd/sd.c in QEMU 4.2.0 uses an unvalidated address, which leads to an out-of-bounds read during sdhci\_write() operations. (no CVSS)
- [CVE-2020-4379](https://cve.now/CVE-2020-4379.md): IBM Spectrum Scale 5.0.0.0 through 5.0.4.4 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly (CVSS 5.9, IBM Spectrum Scale)
- [CVE-2020-4378](https://cve.now/CVE-2020-4378.md): IBM Spectrum Scale 5.0.0.0 through 5.0.4.4 could allow a privileged authenticated user to perform unauthorized actions using a specially cra (CVSS 4.9, IBM Spectrum Scale)
- [CVE-2020-4358](https://cve.now/CVE-2020-4358.md): IBM Spectrum Scale 5.0.0.0 through 5.0.4.4 is vulnerable to cross-site scripting. (CVSS 5.4, IBM Spectrum Scale)
- [CVE-2020-4357](https://cve.now/CVE-2020-4357.md): IBM Spectrum Scale 5.0.0.0 through 5.0.4.4 could allow a remote attacker to obtain sensitive information when a detailed technical error mes (CVSS 4.3, IBM Spectrum Scale)
- [CVE-2020-4350](https://cve.now/CVE-2020-4350.md): IBM Spectrum Scale 5.0.0.0 through 5.0.4.4 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly (CVSS 5.9, IBM Spectrum Scale)
- [CVE-2020-4349](https://cve.now/CVE-2020-4349.md): IBM Spectrum Scale 5.0.0.0 through 5.0.4.4 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly (CVSS 5.9, IBM Spectrum Scale)
- [CVE-2020-4348](https://cve.now/CVE-2020-4348.md): IBM Spectrum Scale 4.2.0.0 through 4.2.3.21 and 5.0.0.0 through 5.0.4.4 could allow an authenticated GUI user to perform unauthorized action (CVSS 6.5, IBM Spectrum Scale)
- [CVE-2020-4226](https://cve.now/CVE-2020-4226.md): IBM MobileFirst Platform Foundation 8.0.0.0 stores highly sensitive information in URL parameters. (CVSS 5.9, IBM MobileFirst Platform Foundation)
- [CVE-2020-13386](https://cve.now/CVE-2020-13386.md): In SmartDraw 2020 27.0.0.0, the installer gives inherited write permissions to the Authenticated Users group on the SmartDraw 2020 installat (CVSS 8.2)
- [CVE-2019-20806](https://cve.now/CVE-2019-20806.md): An issue was discovered in the Linux kernel before 5.2. (no CVSS)
- [CVE-2020-10737](https://cve.now/CVE-2020-10737.md): A race condition was found in the mkhomedir tool shipped with the oddjob package in versions before 0.34.5 and 0.34.6 wherein, during the ho (CVSS 6.3, Red Hat oddjob)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2020-05-27
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.