# CVEs published 2020-06-12

28 CVEs were published on June 12, 2020: 0 critical, 0 high. Days are UTC.

- [CVE-2020-11839](https://cve.now/CVE-2020-11839.md): Cross Site Scripting (XSS) vulnerability in Micro Focus ArcSight Logger product, affecting all version from 6.6.1 up to version 7.0.1. (no CVSS, ArcSight Logger.)
- [CVE-2020-13656](https://cve.now/CVE-2020-13656.md): In Morgan Stanley Hobbes through 2020-05-21, the array implementation lacks bounds checking, allowing exploitation of an out-of-bounds (OOB) (no CVSS)
- [CVE-2019-16252](https://cve.now/CVE-2019-16252.md): Missing SSL Certificate Validation in the Nutfind.com application through 3.9.12 for Android allows a man-in-the-middle attacker to sniff an (no CVSS)
- [CVE-2020-10752](https://cve.now/CVE-2020-10752.md): A flaw was found in the OpenShift API Server, where it failed to sufficiently protect OAuthTokens by leaking them into the logs when an API (no CVSS, openshift/openshift-apiserver)
- [CVE-2020-11980](https://cve.now/CVE-2020-11980.md): In Karaf, JMX authentication takes place using JAAS and authorization takes place using ACL files. (no CVSS, Apache Karaf · org.apache.karaf.management:org.apache.karaf…)
- [CVE-2019-15123](https://cve.now/CVE-2019-15123.md): The Branding Module in Viki Vera 4.9.1.26180 allows an authenticated user to change the logo on the website. (no CVSS)
- [CVE-2020-4047](https://cve.now/CVE-2020-4047.md): Authenticated XSS via media attachment page in WordPress (CVSS 6.8, wordpress-develop)
- [CVE-2020-4048](https://cve.now/CVE-2020-4048.md): Open redirect in wp\_validate\_redirect() in WordPress (CVSS 5.7, wordpress-develop)
- [CVE-2020-4049](https://cve.now/CVE-2020-4049.md): Authenticated self-XSS via theme uploads in WordPress (CVSS 2.4, wordpress-develop)
- [CVE-2020-4050](https://cve.now/CVE-2020-4050.md): set-screen-option filter misuse by plugins leading to privilege escalation in WordPress (CVSS 3.5, wordpress-develop)
- [CVE-2020-4046](https://cve.now/CVE-2020-4046.md): Authenticated XSS through embed block in WordPress (CVSS 5.4, wordpress-develop)
- [CVE-2020-14004](https://cve.now/CVE-2020-14004.md): An issue was discovered in Icinga2 before v2.12.0-rc1. (no CVSS)
- [CVE-2020-9633](https://cve.now/CVE-2020-9633.md): Adobe Flash Player Desktop Runtime 32.0.0.371 and earlier, Adobe Flash Player for Google Chrome 32.0.0.371 and earlier, and Adobe Flash Play (no CVSS, Adobe Flash Player)
- [CVE-2020-9651](https://cve.now/CVE-2020-9651.md): Adobe Experience Manager versions 6.5 and earlier have a cross-site scripting (reflected) vulnerability. (no CVSS, Adobe Experience Manager)
- [CVE-2020-9647](https://cve.now/CVE-2020-9647.md): Adobe Experience Manager versions 6.5 and earlier have a cross-site scripting (dom-based) vulnerability. (no CVSS, Adobe Experience Manager)
- [CVE-2020-9636](https://cve.now/CVE-2020-9636.md): Adobe Framemaker versions 2019.0.5 and below have a memory corruption vulnerability. (no CVSS, Adobe Framemaker)
- [CVE-2020-9644](https://cve.now/CVE-2020-9644.md): Adobe Experience Manager versions 6.5 and earlier have a cross-site scripting (stored) vulnerability. (no CVSS, Adobe Experience Manager)
- [CVE-2020-9634](https://cve.now/CVE-2020-9634.md): Adobe Framemaker versions 2019.0.5 and below have an out-of-bounds write vulnerability. (no CVSS, Adobe Framemaker)
- [CVE-2020-9648](https://cve.now/CVE-2020-9648.md): Adobe Experience Manager versions 6.5 and earlier have a cross-site scripting vulnerability. (no CVSS, Adobe Experience Manager)
- [CVE-2020-9643](https://cve.now/CVE-2020-9643.md): Adobe Experience Manager versions 6.5 and earlier have a server-side request forgery (ssrf) vulnerability. (no CVSS, Adobe Experience Manager)
- [CVE-2020-9645](https://cve.now/CVE-2020-9645.md): Adobe Experience Manager versions 6.5 and earlier have a blind server-side request forgery (ssrf) vulnerability. (no CVSS, Adobe Experience Manager)
- [CVE-2020-9635](https://cve.now/CVE-2020-9635.md): Adobe Framemaker versions 2019.0.5 and below have an out-of-bounds write vulnerability. (no CVSS, Adobe Framemaker)
- [CVE-2020-4251](https://cve.now/CVE-2020-4251.md): IBM API Connect 5.0.0.0 through 5.0.8.8 is vulnerable to cross-site scripting. (CVSS 5.4, IBM API Connect)
- [CVE-2020-3930](https://cve.now/CVE-2020-3930.md): GeoVision Door Access Control Device - Information disclosure vulnerability (CVSS 4.0, GeoVision Door Access Control Device)
- [CVE-2020-3929](https://cve.now/CVE-2020-3929.md): GeoVision Door Access Control Device - Shared cryptographic keys (CVSS 5.9, GeoVision Door Access Control Device)
- [CVE-2020-3928](https://cve.now/CVE-2020-3928.md): GeoVision Door Access Control Device - Hardcoded privileged password (CVSS 6.2, GeoVision Door Access Control Device)
- [CVE-2020-14048](https://cve.now/CVE-2020-14048.md): Zoho ManageEngine ServiceDesk Plus before 11.1 build 11115 allows remote unauthenticated attackers to change the installation status of depl (no CVSS)
- [CVE-2020-10732](https://cve.now/CVE-2020-10732.md): A flaw was found in the Linux kernel's implementation of Userspace core dumps. (CVSS 3.3, Linux kernel kernel)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2020-06-12
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.