# CVEs published 2020-06-06

5 CVEs were published on June 6, 2020: 0 critical, 0 high. Days are UTC.

- [CVE-2020-13890](https://cve.now/CVE-2020-13890.md): The Neon theme 2.0 before 2020-06-03 for Bootstrap allows XSS via an Add Task Input operation in a dashboard. (no CVSS)
- [CVE-2020-13889](https://cve.now/CVE-2020-13889.md): showAlert() in the administration panel in Bludit 3.12.0 allows XSS. (no CVSS)
- [CVE-2020-13883](https://cve.now/CVE-2020-13883.md): In WSO2 API Manager 3.0.0 and earlier, WSO2 API Microgateway 2.2.0, and WSO2 IS as Key Manager 5.9.0 and earlier, Management Console allows (CVSS 5.5)
- [CVE-2020-13881](https://cve.now/CVE-2020-13881.md): In support.c in pam\_tacplus 1.3.8 through 1.5.1, the TACACS+ shared secret gets logged via syslog if the DEBUG loglevel and journald are use (no CVSS)
- [CVE-2020-13871](https://cve.now/CVE-2020-13871.md): SQLite 3.32.2 has a use-after-free in resetAccumulator in select.c because the parse tree rewrite for window functions is too late. (no CVSS, platform/external/sqlite · sqlite)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2020-06-06
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.